Office (OLE) / .XLSX malware analysis — malicious · 5c4a34afb276cd6a

MALICIOUS

Office (OLE) / .XLSX

38.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-07-11

MD5: b81ca19829a7abf9ca23ff30c68ac330 SHA-1: 0f1055346beaf78c3fd7c1250d747fa2e9d6feda SHA-256: 5c4a34afb276cd6a89fcc3e89229b4a15c0b6bdf1a18ae4200f452b941119f9d

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1059.003 Windows Command Shell

The critical heuristic OLE_VBA_CELL_GETOBJECT_EXEC indicates that VBA code is executing content from worksheet cells, likely to launch a payload. The VBA macro in macros.bas constructs a batch file named 'YWiLB.bat' in the user's profile directory and then attempts to execute it using GetObject. This suggests a downloader or dropper functionality.

Heuristics 5

VBA instantiates/executes content from worksheet cells critical OLE_VBA_CELL_GETOBJECT_EXEC

VBA passes a worksheet cell/comment reference to GetObject and drives an Exec/Open/Run sink. Malware hides the COM moniker and command in cell data so the macro source carries no literal indicators.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ff352f3d45b9d452cfc53acd10ef4d6da4c9ef679351eaf91a5caec01cc81764`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.