Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 37b117fc9693ee43…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:38:34 Authoring application: Microsoft Excel First seen: 2021-10-05
MD5: 25c41d2da0dfbceb1c7455828ed18d91 SHA-1: 53e7a02d32de4067604b6598c337a5bff09115de SHA-256: 37b117fc9693ee43c9b45f15a1de76b1ca3f24729f82fa6e2ad60198e0db9252
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 (XLM) macros, specifically an Auto_Open defined name, which is a known technique for executing malicious code upon opening the workbook. The critical heuristic firings indicate the presence of dangerous formula APIs within the XLM macro, suggesting an intent to exploit this functionality for malicious purposes. No specific IOCs like URLs or hashes were extracted, but the technique itself is highly suspicious.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6576 bytes
SHA-256: da73b69d121722b003985f02a064b3cde5aab154039749fb8e0a74d881d667f9
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  sUt
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!D157 
' 0018     21 LABEL : Cell Value, String Constant - cCggFp len=0 
' 0018     26 LABEL : Cell Value, String Constant - CJbzkVJiIwm len=0 
' 0018     26 LABEL : Cell Value, String Constant - hlVMJucXpcn len=0 
' 0018     27 LABEL : Cell Value, String Constant - IRfzegNLyGGA len=0 
' 0018     22 LABEL : Cell Value, String Constant - JdEJZcm len=0 
' 0018     20 LABEL : Cell Value, String Constant - kaKJd len=0 
' 0018     26 LABEL : Cell Value, String Constant - KuRbLbIRVJk len=0 
' 0018     20 LABEL : Cell Value, String Constant - NNNwv len=0 
' 0018     22 LABEL : Cell Value, String Constant - pbHRzSi len=0 
' 0018     25 LABEL : Cell Value, String Constant - qeRdVqADqu len=0 
' 0018     22 LABEL : Cell Value, String Constant - tGSPJQV len=0 
' 0018     22 LABEL : Cell Value, String Constant - tmZUFCk len=0 
' 0018     20 LABEL : Cell Value, String Constant - VViHc len=0 
' 0018     21 LABEL : Cell Value, String Constant - wjbeTE len=0 
' 0018     22 LABEL : Cell Value, String Constant - WMWxtEk len=0 
' 0018     21 LABEL : Cell Value, String Constant - XGjutC len=0 
' 0018     22 LABEL : Cell Value, String Constant - yeAAMLR len=0 
' 0018     26 LABEL : Cell Value, String Constant - YtlRiBACblg len=0 
' 0018     20 LABEL : Cell Value, String Constant - yVleX len=0 
' 0018     27 LABEL : Cell Value, String Constant - yVYcekbhupmV len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.