Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 58f67d10ac40c5f9…

MALICIOUS

Office (OLE) / .XLS

489.0 KB Created: 2010-05-25 11:09:35 Authoring application: Microsoft Excel
MD5: 600d82290cf54f558a06ea8810725cb3 SHA-1: dbedd1d1159c396eca437abf9f55ed49c4a124db SHA-256: 58f67d10ac40c5f9a6274f7c92cad991e835e1a66b1048c6886b347d99975c45
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file contains VBA macros, specifically a Workbook_Open auto-exec macro that utilizes CreateObject. This indicates the macro is designed to run arbitrary code upon opening the Excel file. The presence of ShellExecute API calls further supports the execution of external commands or payloads. While the document body discusses calibration certificates, the macro's behavior strongly suggests it's a downloader or dropper for malicious content. No specific family could be identified.

Heuristics 8

  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.exceltip.com/st/Copy_modules_from_one_workbook_to_another_using_VBA_in_Microsoft_Excel/501.html
    • http://www.excelguru.ca/node/21#MultiSingle
    • http://sourceforge.net/projects/pdfcreator/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
bbb81d212991dd0d4a3ddd8b869fc17ca72ba4122f21d6d86d64bc036fb942c3		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 165064 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 shell/COM execution token(s). Carved artifact contains 15 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.