Office (OLE) / .XLS malware analysis — malicious · 4e380065d1bf7c83

MALICIOUS

Office (OLE) / .XLS

325.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel

MD5: 07be2bbb25c6af7c0ee124dd823196e6 SHA-1: 2ae5038cc6cb4cfceb3dae07e3b4400b6bfef441 SHA-256: 4e380065d1bf7c83b5d986c190cf8886046cf91e7408573d67fe01203efec1a2

340 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains both Excel 4.0 (XLM) and VBA macros. The XLM macro sheet has an Auto_Open entry and uses dangerous functions like RUN and EXEC. The VBA code explicitly calls URLDownloadToFile to download a file from "http://foresah.com/ds/1712.gif" and saves it to a path constructed from sheet data. This indicates the primary purpose is to download and execute a second-stage payload.

Heuristics 7

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME

oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN

Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
ClamAV: Doc.Downloader.Docusign0521-9864805-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Docusign0521-9864805-0
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `6d105297a3a4cfdc5c7c8c3cc101ee970587957a058bce962f4bc5360b4e8f8f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1686 bytes
`macros.bas` `bdd3b85e07b194d2432d5db1744d79ca82727bd20a6ccf84313354c0dfd8f7a8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2017 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.