Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 518998b37f6e9f1f…

MALICIOUS

Office (OLE)

195.5 KB Created: 2018-12-19 10:42:12 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: 6f9e524d4d9f2cfbd9b785f777bb684a SHA-1: fad12429c5a0bcacfae6df9ce7098de673b687df SHA-256: 518998b37f6e9f1f7fb102503272d0a3e4a3e37500985a8cdb1d495078e22951
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains Excel 4.0 macros that are configured to automatically execute upon opening. These macros construct and execute commands using msiexec.exe to download and run payloads from the URLs http://lecmess.top/dat1 and http://jbswin.net/rt3. The ClamAV detection 'Xls.Dropper.Agent-7004279-0' further supports the malicious nature of this file.

Heuristics 6

  • ClamAV: Xls.Dropper.Agent-7004279-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7004279-0
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • URL reconstructed from XLM cell array (2 URLs) critical OLE_XLM_CELL_ARRAY_URL
    Excel 4.0 macro sheet stages its payload URL across the BIFF8 Shared String Table (one quoted-char SST entry concatenated with & at runtime), across individual numeric cells (one ASCII charcode per cell), or split across multi-char fragment cells a download formula concatenates by reference (=A1&A2&… / CONCATENATE(...)). The reconstructed URL is invisible to literal-bytes URL extraction because it is never contiguous in the workbook stream. URLs were recovered by walking the BIFF8 record stream and decoding SST entries, LABELSST/RK/NUMBER cells, and FORMULA cell-reference concatenation in token order.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jbswin.net/rt3 Referenced by macro
    • http://lecmess.top/dat1Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 1852 bytes
SHA-256: c9b9d78dcd1a9fc6958870c174017989850ed71f5e020f73449a2ea278f33049
Preview script
First 1,000 lines of the extracted script
' 0085      9 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden -  
' 0085     13 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Page
' 0085     11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -    
' 0018     31 LABEL : Cell Value, String Constant - breakout1 len=7 ptgRef3d  !E4 
' 0018     31 LABEL : Cell Value, String Constant - breakout2 len=7 ptgRef3d  !F10 
' 0018     28 LABEL : Cell Value, String Constant - Labos1 len=7 ptgRef3d  !E4 
' 0018     28 LABEL : Cell Value, String Constant - Labos2 len=7 ptgRef3d  !F10 
' 0018     28 LABEL : Cell Value, String Constant - Macro1 len=7 ptgRef3d  !E4 
' 0018     28 LABEL : Cell Value, String Constant - Macro2 len=7 ptgRef3d  !F10 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  !D2 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  ,D2,breakout1(),""
'  ,D3,HALT(),""
'  ,E5,breakout2(),""
'  ,E8,RETURN(),""
'  ,F11,IF(L2+M2>0),""
'  ,F13,"EXEC( !A32,2)",""
'  ,F14,"MESSAGE(TRUE,"Done")",""
'  ,F20,*STACKERROR* not enough arguments for function: ELSE,""
'  ,F21,PAUSE(),""
'  ,F23,*STACKERROR* not enough arguments for function: END.IF,""
'  ,F24,RETURN(),""
'  ,A33,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.