Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5354a627f64e280f…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:34:41 Authoring application: Microsoft Excel First seen: 2021-07-10
MD5: cc70c150389fd87f1a9bfd41d1cc5f2b SHA-1: 45513035ce065aa7041ccd400741a433c3fe3b55 SHA-256: 5354a627f64e280ff78b5bf97e16040a5ab18488454d19121a79ab89f3df72eb
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open defined name, which is a critical finding. This indicates an attempt to automatically execute code upon opening the workbook. The presence of dangerous formula APIs like RUN further supports the malicious intent. The macro sheet itself is likely designed to download and execute a second-stage payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6509 bytes
SHA-256: 3c523991c0cad4ed2eb0cd4a6d9c17b91c34da1870b9bd5a58a91dda9f075616
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  ZUTlOZ
' 0018     24 LABEL : Cell Value, String Constant - ArFVCaddF len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H135 
' 0018     24 LABEL : Cell Value, String Constant - AxQMKOtNW len=0 
' 0018     20 LABEL : Cell Value, String Constant - ctACQ len=0 
' 0018     21 LABEL : Cell Value, String Constant - GhQptV len=0 
' 0018     20 LABEL : Cell Value, String Constant - hGAJW len=0 
' 0018     20 LABEL : Cell Value, String Constant - hlBWk len=0 
' 0018     27 LABEL : Cell Value, String Constant - IRfQTrzBkOsQ len=0 
' 0018     26 LABEL : Cell Value, String Constant - KlSNKgYpNIg len=0 
' 0018     23 LABEL : Cell Value, String Constant - lDLKfZAE len=0 
' 0018     20 LABEL : Cell Value, String Constant - MtrJT len=0 
' 0018     27 LABEL : Cell Value, String Constant - npyphPuiKGXS len=0 
' 0018     20 LABEL : Cell Value, String Constant - OQSIu len=0 
' 0018     27 LABEL : Cell Value, String Constant - pzPUxixoWUCG len=0 
' 0018     20 LABEL : Cell Value, String Constant - qkJss len=0 
' 0018     20 LABEL : Cell Value, String Constant - RLWXD len=0 
' 0018     20 LABEL : Cell Value, String Constant - TSEZI len=0 
' 0018     25 LABEL : Cell Value, String Constant - wHmlCyAUov len=0 
' 0018     22 LABEL : Cell Value, String Constant - xngcYAW len=0 
' 0018     27 LABEL : Cell Value, String Constant - YubVRLRyQDhs len=0 
' 0018     26 LABEL : Cell Value, String Constant - yVVcUSpiMgO len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSS
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.