Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3f10af514c592b80…

MALICIOUS

Office (OLE)

225.0 KB Created: 1999-05-05 13:56:36 Authoring application: Microsoft Excel
MD5: 9849f60eeca3a13814206e867c66a79d SHA-1: 9d97bd2d922dbe00836b3a98e672d17a96f947d8 SHA-256: 3f10af514c592b808a7aef6f31b06bc121738b6b86c3c5ab4914d3db611b7e08
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Excel document containing VBA macros, including Auto_Open and Auto_Close, which are commonly used for malicious purposes. The macros are obfuscated, suggesting an intent to hide their functionality. The presence of an embedded URL, http://inlinecl.zuo.cpqcorp.net/intranet/quality/standard_templates/st_styles, strongly indicates that the macros are intended to download and execute a second-stage payload. The document body presents itself as a resource usage template, a common lure for macro-based attacks.

Heuristics 5

  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://inlinecl.zuo.cpqcorp.net/intranet/quality/standard_templates/st_styles
    • http://;file://;mailto:;https://;ftp://
    • http://onsite-ocsp.verisign.com0��
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://onsitecrl.verisign.com/HewlettPackardCompanyITInfrastructure/LatestCRL.crl���ldap://ldap.hp.com/CN=Hewlett-Packard%20Primary%20Class%202%20Certification%20Authority,O=Hewlett-Packard%20Company,C=US,OU=IT%20Infrastructure,O=hp.com?certificaterevocationlist;binary0
    • http://digitalbadge.hp.com/cp0�

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
1a6f4e47859bb799200f7f6fd81c361578c7a4a0fbefdd9e663d5a3d43965cce		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 17880 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.