MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file is an Excel 4.0 macro-enabled workbook. Static analysis identified an Auto_Open defined name, which is a critical indicator of malicious intent as it allows for automatic execution of XLM macros upon opening. The presence of dangerous formula APIs like RUN further confirms the capability to execute arbitrary code. The macro sheet itself contains obfuscated strings and potentially malicious formulas, suggesting it's designed to download and execute a secondary payload.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 6938 bytes |
SHA-256: b41faab5504a35fbec604bf5ed372fccae5dad88d1b69c40067560383ca30b7a |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - tdyBwdDlSTh ' 0018 23 LABEL : Cell Value, String Constant - ASDuyNEy len=0 ' 0018 22 LABEL : Cell Value, String Constant - AuCxgDF len=0 ' 0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d Sheet!A152 ' 0018 24 LABEL : Cell Value, String Constant - BXvGCFUWb len=0 ' 0018 25 LABEL : Cell Value, String Constant - cVIRkdgZbQ len=0 ' 0018 25 LABEL : Cell Value, String Constant - djfTzLOKDH len=0 ' 0018 27 LABEL : Cell Value, String Constant - DkrYSwYjTsiB len=0 ' 0018 20 LABEL : Cell Value, String Constant - dZHBD len=0 ' 0018 24 LABEL : Cell Value, String Constant - FKWMDpNMt len=0 ' 0018 24 LABEL : Cell Value, String Constant - kDxuarCIe len=0 ' 0018 22 LABEL : Cell Value, String Constant - KGAbNKR len=0 ' 0018 21 LABEL : Cell Value, String Constant - nKWSQx len=0 ' 0018 25 LABEL : Cell Value, String Constant - rizIPvQkMK len=0 ' 0018 24 LABEL : Cell Value, String Constant - rppKxWnmX len=0 ' 0018 22 LABEL : Cell Value, String Constant - RqrAEtA len=0 ' 0018 20 LABEL : Cell Value, String Constant - sFAMl len=0 ' 0018 27 LABEL : Cell Value, String Constant - VvDKZOvLOFqP len=0 ' 0018 20 LABEL : Cell Value, String Constant - Wlmoc len=0 ' 0018 27 LABEL : Cell Value, String Constant - YiTiBHeSeodZ len=0 ' 0018 24 LABEL : Cell Value, String Constant - yNLhXMDAN len=0 ' 0018 23 LABEL : Cell Value, String Constant - ZUdwhCwa len=0 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.