Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3a02f5d69f03c24a…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-25 10:42:27 Authoring application: Microsoft Excel First seen: 2021-10-16
MD5: 30996dbb1b3a075a7b67c5e80517b9b2 SHA-1: c9927130ec260f0a9e25af90d5a53a91a91e90eb SHA-256: 3a02f5d69f03c24af9c9520a0f156452896e7ff2cc571b90bd2b19f0f706a28a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 (XLM) macro sheets with an Auto_Open defined name, indicating automatic execution upon opening. Heuristics also identified dangerous formula APIs being used, specifically the RUN function, which is commonly used to execute arbitrary code. The presence of XLM macros suggests the file is designed to download and execute a secondary payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6594 bytes
SHA-256: bd580dd7a1cbac4d7eb1a05c146515a488ca3fc7696b0e011d7419de7b50f51a
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     17 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  oJWjlXpD
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H159 
' 0018     27 LABEL : Cell Value, String Constant - BQVJiOCqrlkI len=0 
' 0018     27 LABEL : Cell Value, String Constant - dHZpVIMejDWd len=0 
' 0018     27 LABEL : Cell Value, String Constant - DXgPbolisptk len=0 
' 0018     21 LABEL : Cell Value, String Constant - EeIhsU len=0 
' 0018     21 LABEL : Cell Value, String Constant - fJHJmU len=0 
' 0018     24 LABEL : Cell Value, String Constant - HCpMADUFL len=0 
' 0018     20 LABEL : Cell Value, String Constant - hlLXE len=0 
' 0018     21 LABEL : Cell Value, String Constant - IXocJn len=0 
' 0018     23 LABEL : Cell Value, String Constant - jvPSWNOt len=0 
' 0018     26 LABEL : Cell Value, String Constant - kcDuaZZfziY len=0 
' 0018     26 LABEL : Cell Value, String Constant - lgmwyUOiGgG len=0 
' 0018     23 LABEL : Cell Value, String Constant - LOMUFozo len=0 
' 0018     21 LABEL : Cell Value, String Constant - MWDBlu len=0 
' 0018     22 LABEL : Cell Value, String Constant - oMmUdbN len=0 
' 0018     22 LABEL : Cell Value, String Constant - qMomRIs len=0 
' 0018     24 LABEL : Cell Value, String Constant - rFgQTTJlQ len=0 
' 0018     25 LABEL : Cell Value, String Constant - RkdDohasxf len=0 
' 0018     21 LABEL : Cell Value, String Constant - uHJTWO len=0 
' 0018     24 LABEL : Cell Value, String Constant - vhJFhWgdA len=0 
' 0018     26 LABEL : Cell Value, String Constant - vQVjZqeUiiX len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.