Office (OLE) / .XLS malware analysis — malicious · 6030974a1832e7d2

MALICIOUS

Office (OLE) / .XLS

234.5 KB Created: 2018-12-06 20:43:11 Authoring application: Microsoft Excel

MD5: d041f153e6c295c7de6ddf5e6bc0f66b SHA-1: 67ea7e42f1b314d595b0bf44491346f33e8d8f34 SHA-256: 6030974a1832e7d2b3200be230f610a2ef0b18220b4beedb28f6e35ceb048e4c

400 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1204.002 Malicious File

This Excel file contains both VBA and XLM macros, with a critical Workbook_Open VBA macro that utilizes WScript.Shell to execute commands. The presence of OLE_VBA_HTTP_DROP_EXEC indicates the macro is designed to download and save a file, likely a second-stage payload. The 'Note: Enable content to display this spreadsheet in your screen size' is a common lure to trick users into enabling macros.

Heuristics 10

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `fdf54781a82ae0e2ee4ed555249a0a3f8ca98d330e9ee978a2c7c54b7002dab4`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	949 bytes
`macros.bas` `81ccb838fe8221055ea97f591ab4739ef527d6feff923533801d9ca49e0fdd8d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	454276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.