Malicious Office (OLE) / .VBA — malware analysis report

Static analysis result for SHA-256 4477fd17cf805493…

MALICIOUS

Office (OLE) / .VBA

1.42 MB Created: 1997-05-24 20:46:20 Authoring application: Microsoft Excel
MD5: f83543f791f07ea159e6c4d7e299a202 SHA-1: 3e2e328f6a643e3bc589b785abc7e77f791daaa3 SHA-256: 4477fd17cf80549302566e1b039eab4d0feb2f621de17645cd8a9ecbcfec1ace
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.004 Visual Basic for Applications

The file is an Excel 4.0 macro sheet (XLM) and contains VBA macros, indicated by the OLE_XLM_AUTOOPEN and OLE_VBA_MACROS heuristics. The VBA macro code includes functions like 'ZapiszSie' which saves the workbook as 'B_PLUS.VBA' and attempts to save it again using a variable 'PLUS_Nazwa', suggesting an attempt to save or copy malicious components. The presence of obfuscated VBA strings and the XLM macro sheet structure points towards a downloader or information-stealing malware.

Heuristics 3

  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
3bf1d33dd64e6a3821038c5290618c259d17a3bcc0b4d224f8ce1711e9a6f58a
xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 1637 bytes
macros.bas
83db56350b9b659db943c300ca9d455a5ef3d11a5c4a074aedcd618563e03e31
vba-macro oletools.olevba.extract_macros (decoded VBA source) 656533 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 21 Chr/ChrW string-construction calls.