MALICIOUS
220
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is an Excel 4.0 macro-enabled document containing an Auto_Open function, which is a critical finding indicating automatic execution upon opening. The presence of dangerous formula APIs and environment evasion techniques suggests malicious intent. The document body contains obfuscated strings, and while no direct URLs or executable payloads were extracted, the Auto_Open macro is designed to execute arbitrary code, likely downloading and running a second-stage payload.
Heuristics 5
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
XLM Auto_Open environment-evasion close gate critical OLE_XLM_ENVIRONMENT_EVASION_CLOSEExcel 4.0 macro sheet auto-executes environment checks with GET.WORKSPACE / GET.WINDOW, then shows a fake corruption/error message and closes the workbook when the host fails those checks. This is a malware sandbox-evasion pattern, even when the later payload stage is hidden behind obfuscated defined-name flow.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 61519 bytes |
SHA-256: a0396219674b8e275a329dfdfa03fd543645442ff8783cd6220e9851d3b24cdc |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 10 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - v ' 0085 24 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - DuTwbZHvQHxLVEE ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0018 22 LABEL : Cell Value, String Constant - aHkBhnH len=0 ' 0018 64 LABEL : Cell Value, String Constant - aHPQOTExFivuLPSJixqaIKfIMakFTGsTpoRxQCGfGRLdawTrj len=0 ' 0018 64 LABEL : Cell Value, String Constant - aoyhhUUvERsMrQhtifZroLuGMITklHISpWzQvDWeTyuusxjcj len=0 ' 0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d v!DZ20620 ' 0018 21 LABEL : Cell Value, String Constant - aXtPot len=0 ' 0018 22 LABEL : Cell Value, String Constant - azPHrZb len=0 ' 0018 24 LABEL : Cell Value, String Constant - bMtvQsxMW len=0 ' 0018 17 LABEL : Cell Value, String Constant - BN len=0 ' 0018 25 LABEL : Cell Value, String Constant - BPZtIuhIed len=0 ' 0018 31 LABEL : Cell Value, String Constant - bXjBPXYhFzdfMSlt len=0 ' 0018 21 LABEL : Cell Value, String Constant - cCeKHp len=0 ' 0018 49 LABEL : Cell Value, String Constant - cCRJtbdybftEYmZMmJIkRiVZyZkewtQmLD len=0 ' 0018 21 LABEL : Cell Value, String Constant - Cdcsil len=0 ' 0018 43 LABEL : Cell Value, String Constant - cdyzKhOrHnuNVLqlmkpaUbFgRhlo len=0 ' 0018 32 LABEL : Cell Value, String Constant - CjlGinBMgthTuRQrZ len=0 ' 0018 60 LABEL : Cell Value, String Constant - ClhWqgXlveeREeBOcKbNRqfcWolIeDJFQUiEGPYTwNfzT len=0 ' 0018 38 LABEL : Cell Value, String Constant - coRkQoGSGExQNjTekgrJKfg len=0 ' 0018 23 LABEL : Cell Value, String Constant - CPOeikcC len=0 ' 0018 53 LABEL : Cell Value, String Constant - cpoFILDbqjTBEYBFTdyMylNjhKrJuyZyKEWTqM len=0 ' 0018 52 LABEL : Cell Value, String Constant - CQaJJviJfsHoGrvVKHBTQmJhnjuyNiktDxbrK len=0 ' 0018 50 LABEL : Cell Value, String Constant - CsShaKruPrvKGoDccDMYBUzXpPpBuNwTDNT len=0 ' 0018 23 LABEL : Cell Value, String Constant - csvyqPeX len=0 ' 0018 25 LABEL : Cell Value, String Constant - cVcHhTjmph len=0 ' 0018 24 LABEL : Cell Value, String Constant - CVdTytusx len=0 ' 0018 24 LABEL : Cell Value, String Constant - CvOLiEcie len=0 ' 0018 22 LABEL : Cell Value, String Constant - CwacJci len=0 ' 0018 55 LABEL : Cell Value, String Constant - cwCKzfoonrPWdIUUjnqiHWPygjEgkyverRRsBNpJ len=0 ' 0018 52 LABEL : Cell Value, String Constant - dDIFQTiEFOYTwMfySNChqrpufYfKXWmqskKZR len=0 ' 0018 20 LABEL : Cell Value, String Constant - dgYwM len=0 ' 0018 48 LABEL : Cell Value, String Constant - DidechSZgwXXmdfXwZECjYsjanyhgUUvE len=0 ' 0018 21 LABEL : Cell Value, String Constant - DmxEzL len=0 ' 0018 24 LABEL : Cell Value, String Constant - DNvviVvSf len=0 ' 0018 23 LABEL : Cell Value, String Constant - dnwrVlEY len=0 ' 0018 24 LABEL : Cell Value, String Constant - doGUcdnLG len=0 ' 0018 21 LABEL : Cell Value, String Constant - dWdIUT len=0 ' 0018 33 LABEL : Cell Value, String Constant - dWHoqLnsGQlymYzWVw len=0 ' 0018 20 LABEL : Cell Value, String Constant - DxbqK len=0 ' 0018 21 LABEL : Cell Value, String Constant - DynIxo len=0 ' 0018 21 LABEL : Cell Value, String Constant - ejUNUy len=0 ' 0018 39 LABEL : Cell Value, String Constant - eKFGEJunuZzkBFIyYBgQMBVL len=0 ' 0018 23 LABEL : Cell Value, String Constant - eKhzMzxr ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.