Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 4f0fb899485f6d9c…

MALICIOUS

Office (OLE) / .XLS

77.5 KB Created: 2018-12-06 20:43:11 Authoring application: Microsoft Excel First seen: 2023-08-24
MD5: 081d0f7ac1c7cd48552556d430227666 SHA-1: 61212801d6fc07885b0f209c93debbdffee5afc0 SHA-256: 4f0fb899485f6d9c4fc0362a0523b062458086dec746a4a20936feeda6cbc8d1
348 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1204.002 Malicious File T1059.001 PowerShell T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is a macro-enabled Excel file that contains a Workbook_Open macro. This macro utilizes ShellExecuteA and URLDownloadToFileA APIs, indicating an intent to download and execute a second-stage payload. The document body contains a lure instructing the user to 'Enable content' to view the document, which is a common tactic for macro-based malware.

Heuristics 9

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • ClamAV: Xls.Malware.Valyria-10028013-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10028013-0
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f805037fe97e6aef5ef60ce9d7b6c50efb5b681e942bb44051833dee4d2fbf7b		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 8527 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.