Office (OLE) / .XLS malware analysis — malicious · 5e7ddcc8aa2977cc

MALICIOUS

Office (OLE) / .XLS

473.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel

MD5: bb2e7e44ba95cb90cbb138fcbadaac3d SHA-1: 450f9c1101e66affdd6f28e0f8a369f1b6d86f9b SHA-256: 5e7ddcc8aa2977cceac204ed424e05270874e2b0da94eb5b056e968126fc9902

508 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing a Workbook_Open macro that uses WScript.Shell to execute a dropped PE executable. The macro attempts to copy an embedded OLE object and paste it into the local application data directory, then executes it as AsyncClient.exe. This indicates a downloader or dropper functionality.

Heuristics 12

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f47015cfdecf3af4cbda8faaa257acac8cdd7fd8377abb89b330baa0eaf5e93c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1175 bytes
`embedded_office_0000188d.exe` `859fa41d1a9389f5471598d6d44a6507812d260210dc9a5c1f7b19bce0409fbf`	embedded-pe	Office MZ+PE at offset 0x188D	478067 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ole10native_00.bin` `b5bda6c25395a15cf02ad3d39fc107b8d9b39dac5e0f2ae603a48edeec80f36e`	ole-package	OLE Ole10Native stream: MBD000FBD6F/Ole10Native	391561 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.