Office (OLE) / .XLS malware analysis — malicious · 616db890660e097d

MALICIOUS

Office (OLE) / .XLS

59.0 KB Created: 2020-06-15 22:54:22 Authoring application: Microsoft Excel

MD5: 294d4575e5eb4f0fc8fb239dfec778a2 SHA-1: 499be3ae1cfb40317bdb79e906d9a38b9228568c SHA-256: 616db890660e097d83f8d9d9c7f7495ce9077853528e924c287a2b8527c3a59a

288 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an Excel file containing a Workbook_Open VBA macro that uses the URLDownloadToFile API to download a second-stage payload from a remote source. The document body displays a lure instructing the user to enable content to view a transaction, which is a common tactic for macro-enabled malware. The macro also calls ShellExecuteA, indicating it will execute the downloaded payload.

Heuristics 8

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bdf23891e7719dd82fd6d5b14b84abda6b680cba48670e6bb653737686ebc275`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13883 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.