Office (OLE) / .XLS malware analysis — malicious · 609cd2cdb1af2f04

MALICIOUS

Office (OLE) / .XLS

95.5 KB Created: 2023-02-22 08:28:02 Authoring application: Microsoft Excel First seen: 2023-02-22

MD5: 7670cf8c49aa75c636387489c7b192c2 SHA-1: de29c1d460beba101cd455749381afa8c4e5735c SHA-256: 609cd2cdb1af2f044285df225ab4ef761927219af0b4e51ab722553e54797817

348 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The XLS file contains VBA macros that leverage WScript.Shell and URLDownloadToFileA to download and execute a secondary payload. The script attempts to obfuscate the download URL by concatenating strings and using a custom function 'meridionali' which appears to construct a URL. The presence of these functions strongly indicates a downloader or droppper functionality.

Heuristics 8

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f42f85c796ec49d2d0fd09ca798ff1f7734e13e3eb424ab25bb17db460ce70c4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2506 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.