Office (OLE) / .XLS malware analysis — malicious · 613935ebeb35882a

MALICIOUS

Office (OLE) / .XLS

80.5 KB Created: 2020-12-08 17:11:45 Authoring application: Microsoft Excel

MD5: 46ec563750cdb571ad5c3f94273d2bb3 SHA-1: 9079eaeed2400a75c395787868d1d16661604094 SHA-256: 613935ebeb35882a0e28b252e411846fdb77d1ef779a9025a5c00c37a6b4901d

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample contains heuristics indicating the use of PowerShell and a command-line execution pattern that downloads a file from a GitHub URL. The embedded URL points to a SVG file, which is likely a disguised executable. This suggests the document is a lure to download and execute a second-stage payload, likely a trojan or backdoor.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://raw.githubusercontent.com/zoroglulu/izzkt1wkzwqyzs/gh-pages/wey5i592km.svg\
- https://raw.githubusercontent.com/zoroglulu/izzkt1wkzwqyzs/gh-pages/wey5i592km.svg

Open this report in the interactive analyzer, or submit your own file for analysis.