Office (OLE) / .XLS malware analysis — malicious · 32f904b0292eedb1

MALICIOUS

Office (OLE) / .XLS

286.1 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: fd1c4d9b3df1020a5eff95f8723cde4e SHA-1: 01134be734a6c4404bf87a6045d078392a07aa3e SHA-256: 32f904b0292eedb1689eb96f2f67ed4ef5016694db7530ad4e912223a50ab287

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.004 Scripting: Command and Scripting Interpreter: PowerShell T1566.001 Phishing: Spearphishing Attachment T1027 Obfuscated Files or Information

The file contains both Excel 4.0 (XLM) and VBA macros, with a Workbook_Open event triggering a subroutine named 'ShotCount'. The presence of XOR-encoded strings and VBA Chr string obfuscation indicates attempts to hide malicious functionality. While the exact payload is not immediately clear from the truncated script, the structure suggests a lure or a downloader. The 'LV' and 'MS' sheet names, along with the game-like interface elements in the VBA code, point towards a deceptive user experience designed to trick the user.

Heuristics 5

XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED

Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'LoadLibraryA', 'GetProcAddress', 'RegOpenKeyExA', 'ShellExecuteA'
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `4223079fde5c7c0a48e89cb7786c8750c29102791c1d113f36e67d5a10299c48`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.