Office (OLE) / .XLS malware analysis — malicious · 413dc27aa34e015e

MALICIOUS

Office (OLE) / .XLS

595.5 KB Created: 2021-06-07 14:41:37 Authoring application: Microsoft Excel

MD5: 7ed5aeed78df9e79bace6fd8d3addd9c SHA-1: 37ef4d9d5eaf9b08b8d4c317f3c99226257246fd SHA-256: 413dc27aa34e015e5cd2a961bdbe31fcffe986b53ddff988cefa062e18c9ac49

290 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The sample is an XLS file containing a Workbook_Open VBA macro that utilizes Shell() and CreateObject() calls. This indicates the macro is designed to execute arbitrary commands, likely to download and run a second-stage payload from one of the embedded URLs. No document body text was available for analysis, so the rationale is based on the macro behavior and extracted URLs.

Heuristics 9

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL https://pcc.po��TrwE��5Y��mmunity/wp-includes/js/tinj2;k
- https://grandvilaformosa.comqdgc4G/wp-��k�
- https://legalmongolia.com/blog.example.com9g&Go9g&Go/fo9g&Gont-awesome/css/nXJjANzDP9g&Go882N0N.php
- https://cliente4.vetcarebahia.com/midias/anexos/6/7/1DyL).If
- https://cliente11.vetcaf:lfLT
- https://pcc.polperrj2;k
- https://ma51+Ehe^kolet51+Ehe^.nsmatri51+Ehe^x3.com/wp-content/plugins/woocommerce/templa51+Ehe^tes/auth/gnq4mYeZYgL4d51+Ehe^N.php
- https://grandvilaformosa.comqdgc4G/wp-content/plugqdgc4Gins/wordpress-seo/css/dist/y9Oqdgc4Gd0UaBeWZ1qdgc4G.php
- https://pedidos.gXq(^i

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e1e486237599f6e8a7f4c79dd14bf8105ed863d243bfb5092659658057b74629`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	125882 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.