Office (OLE) / .XLS malware analysis — malicious · 61a94cb6e7fb5836

MALICIOUS

Office (OLE) / .XLS

52.0 KB Created: 2020-11-16 12:25:15

MD5: 633375f8fcf2804eb10539f79a9455a2 SHA-1: a211b869b8922c0bd99851b6d5a8df16eded2804 SHA-256: 61a94cb6e7fb5836da43a0ebcd751876ff7b3bfc10bb897513c1818f0b520e45

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristic indicates that a VBA ActiveX event triggers a decoded Excel 4.0 macro, which is a common stager technique. The VBA script contains functions that appear to deobfuscate and execute Excel 4.0 macro commands, likely to download and run a secondary payload. The 'DOC BODY' content is heavily obfuscated and does not provide clear instructions.

Heuristics 2

VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER

VBA code attached to an ActiveX/UserForm event decodes strings from worksheet cells through a Mid/Asc/Chr character-shift loop and passes the recovered formula text to ExecuteExcel4Macro. This is a high-confidence macro stager that bridges VBA event activation into XLM formula execution rather than a specific Office parser CVE.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bb395f56140a6cc0cafc305f44c7e513b46c41fef80c6c9e1db5f90e088c183a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.