Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 512dc5b59976c679…

MALICIOUS

Office (OLE) / .XLS

489.5 KB Created: 2010-05-25 11:09:35 Authoring application: Microsoft Excel
MD5: 73dee305dbd484a08c0e5f9c2d44e953 SHA-1: 46a0df6fd25e938fecfaf5a37adb6c682e1ce4c1 SHA-256: 512dc5b59976c679795c141ce0d6385b5d6a7c08201870928eba0f9ef9551fc3
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an Excel file containing VBA macros, with a Workbook_Open auto-execution routine. The heuristics indicate the macro uses CreateObject and ShellExecute, suggesting it attempts to run external commands or download additional payloads. The document body, while in Finnish, appears to relate to calibration certificates, a common lure for macro-enabled documents. No specific family could be identified, but the techniques suggest a downloader or initial access stage.

Heuristics 8

  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.exceltip.com/st/Copy_modules_from_one_workbook_to_another_using_VameBoxl
    • http://www.excelguru.ca/node/21#MultiSingle
    • http://sourceforge.net/projects/pdfcreator/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a9e98de3e4d17bd01140e0431e9542130a4da04213e8d406a56a8d6e2f3286da		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 167190 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 shell/COM execution token(s). Carved artifact contains 15 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.