Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 455bbc53d581bf2e…

MALICIOUS

Office (OLE) / .XLS

279.0 KB Created: 2019-10-22 07:10:34 Authoring application: Microsoft Excel
MD5: 87c4de1093b6114a7269dba51275f1bb SHA-1: 17868e12cedc10199fc849a917b18e31da2020b2 SHA-256: 455bbc53d581bf2e44cdffaae0dd0dfc68bcb46bcbee6f2e0e5033cba7b5ed0c
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Service Execution: Service Control T1059.001 PowerShell T1105 Ingress Tool Transfer T1218.011 System Binary Proxy Execution: Bitsadmin

The file contains Excel 4.0 macros (OLE_XLM_AUTOOPEN, OLE_XLM_DANGEROUS_FN) that are configured to execute commands. Heuristics indicate suspicious invocations of cmd.exe and references to PowerShell and bitsadmin, suggesting the macro is designed to download and execute a second-stage payload from the URL http://office-service-secs.com/blm.task. The document body text does not appear to contain any relevant content for the attack.

Heuristics 8

  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to bitsadmin (download) high SC_STR_BITSADMIN
    Reference to bitsadmin (download)
  • XLM Auto_Open with dangerous formula APIs high OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://office-service-secs.com/blm.task
    • http://www.google.com

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
356cc8ba16de2573ca58c42cef5bfcf9f6ee3f819c9fa0d5a2bd1b4ed729f631		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 1914 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.