Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 412832fc5c1ee7fa…

MALICIOUS

Office (OLE) / .XLS

500.5 KB Created: 2010-05-25 11:09:35 Authoring application: Microsoft Excel
MD5: dad60023156117a28922038150433daa SHA-1: e54f3112ba16ffb93a9b5817f21eb6d359fbccc9 SHA-256: 412832fc5c1ee7fa46113cc8d5dec3a6f26185aa3a92694bd807ac4981db1062
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Excel file containing a Workbook_Open VBA macro, which is a common technique for executing malicious code upon opening. The macro utilizes CreateObject and ShellExecute API calls, indicating an attempt to run external commands or download additional payloads. The presence of VBA p-code auto-execution with execution tokens further supports this. While the document body contains text related to calibration certificates, it does not appear to be directly related to the malicious functionality. The extracted URLs are not definitively malicious, but one is unknown and could be a C2 or download source.

Heuristics 8

  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.exceltip.com/st/Copy_modules_from_one_workbook_to_another_using_VBA_in_Microsoft_Excel/501.html
    • http://www.excelguru.ca/node/21#MultiSingle
    • http://sourceforge.net/projects/pdfcreator/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
c3dc2894288005d7742d634464a745fd916ef9dfdb22be70d43133b882a920fb		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 162555 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 shell/COM execution token(s). Carved artifact contains 15 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.