Office (OLE) / .XLS malware analysis — malicious · 5b0f61b42e9a6c23

MALICIOUS

Office (OLE) / .XLS

54.5 KB Created: 2023-03-09 07:44:43 First seen: 2023-03-09

MD5: d48a431b965ea5c18a33465702ffcecd SHA-1: d736156ea047d2137ce4e2b1aa57fdf28b898bee SHA-256: 5b0f61b42e9a6c238c7028751bf75c484778219cf88a7c5007c2a49e14351e70

288 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The VBA script utilizes `WScript.Shell` and `CreateObject` to download a payload from the URL "http://internetOrios.com" and save it to disk. The script also attempts to obscure the downloaded file's name and potentially its nature by appending information derived from HTTP headers. This indicates a downloader or droppper functionality.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6b54597ed8c591eb69bc3b0375c938bb61ba62e711f93f5bbdb62356cceef3ba`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.