MALICIOUS
220
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains Excel 4.0 (XLM) macros, including an Auto_Open defined name, which are configured to execute automatically upon opening. Heuristics indicate the use of dangerous formula APIs and environment evasion techniques, suggesting the macros are designed to bypass security measures and launch a malicious payload. The presence of a macro-enable lure further supports this malicious intent.
Heuristics 5
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
XLM Auto_Open environment-evasion close gate critical OLE_XLM_ENVIRONMENT_EVASION_CLOSEExcel 4.0 macro sheet auto-executes environment checks with GET.WORKSPACE / GET.WINDOW, then shows a fake corruption/error message and closes the workbook when the host fails those checks. This is a malware sandbox-evasion pattern, even when the later payload stage is hidden behind obfuscated defined-name flow.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 68429 bytes |
SHA-256: ab5d1e88ad5074d01ea2ce5a2458a638643086c348c68048b6a6ed20d7cd1426 |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 10 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - v ' 0085 22 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - VJHBTQmJhnjux ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 15 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2 ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0018 22 LABEL : Cell Value, String Constant - aHkBhnH len=0 ' 0018 64 LABEL : Cell Value, String Constant - aHPQOTExFivuLPSJixqaIKfIMakFTGsTpoRxQCGfGRLdawTrj len=0 ' 0018 64 LABEL : Cell Value, String Constant - aoyhhUUvERsMrQhtifZroLuGMITklHISpWzQvDWeTyuusxjcj len=0 ' 0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d v!DZ20620 ' 0018 21 LABEL : Cell Value, String Constant - aXtPot len=0 ' 0018 22 LABEL : Cell Value, String Constant - azPHrZb len=0 ' 0018 24 LABEL : Cell Value, String Constant - bMtvQsxMW len=0 ' 0018 17 LABEL : Cell Value, String Constant - BN len=0 ' 0018 25 LABEL : Cell Value, String Constant - BPZtIuhIed len=0 ' 0018 31 LABEL : Cell Value, String Constant - bXjBPXYhFzdfMSlt len=0 ' 0018 21 LABEL : Cell Value, String Constant - cCeKHp len=0 ' 0018 49 LABEL : Cell Value, String Constant - cCRJtbdybftEYmZMmJIkRiVZyZkewtQmLD len=0 ' 0018 21 LABEL : Cell Value, String Constant - Cdcsil len=0 ' 0018 43 LABEL : Cell Value, String Constant - cdyzKhOrHnuNVLqlmkpaUbFgRhlo len=0 ' 0018 32 LABEL : Cell Value, String Constant - CjlGinBMgthTuRQrZ len=0 ' 0018 60 LABEL : Cell Value, String Constant - ClhWqgXlveeREeBOcKbNRqfcWolIeDJFQUiEGPYTwNfzT len=0 ' 0018 38 LABEL : Cell Value, String Constant - coRkQoGSGExQNjTekgrJKfg len=0 ' 0018 23 LABEL : Cell Value, String Constant - CPOeikcC len=0 ' 0018 53 LABE ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.