Office (OLE) / .XLS malware analysis — malicious · 663d185dcdb65dd8

MALICIOUS

Office (OLE) / .XLS

71.0 KB Created: 2022-09-22 12:27:35 Authoring application: Microsoft Excel First seen: 2022-09-25

MD5: 1be7ca9e104982dd4b1a2ef0f25c99e4 SHA-1: c299fb532669868af38d9ad4555bf2cde62c3f92 SHA-256: 663d185dcdb65dd8204ca9fa4dfe218a1027fe4026b357d3ab42a0e6d5fea9a6

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The sample contains heuristics indicating the use of PowerShell and a command-line execution pattern that suggests downloading content. The embedded URL, although marked as benign, is likely part of the download mechanism. The document body is heavily obfuscated and truncated, preventing a more detailed analysis of its specific lure.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ogumeta.github.io/vwui/kyhla.png\
- https://ogumeta.github.io/vwui/kyhla.png

Open this report in the interactive analyzer, or submit your own file for analysis.