Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 683ea63713e1c8a9…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:27:59 Authoring application: Microsoft Excel First seen: 2021-10-02
MD5: 11d2e88b78aa3230c3b4526601887f6b SHA-1: 9a6921c1ef33ecb203d78b5184c590c463935c75 SHA-256: 683ea63713e1c8a9b3c0f3c7c5200e7697c54a80c4adea192ad41a75d6c391f0
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristics indicate the presence of Excel 4.0 macros with an Auto_Open entry, which is a known method for executing malicious code upon opening an Excel file. The macro sheet contains dangerous formula APIs, specifically 'RUN', suggesting it is designed to execute external commands or download payloads. The document body contains obfuscated text, further supporting a malicious intent.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6445 bytes
SHA-256: 18057a7c2bf52d045d17cfc03599a0d36c6813605b086407ea7e7016bbf647ac
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  EYvpH
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H180 
' 0018     27 LABEL : Cell Value, String Constant - bNxMTLxRFdpU len=0 
' 0018     25 LABEL : Cell Value, String Constant - ckunUmGiFl len=0 
' 0018     20 LABEL : Cell Value, String Constant - czVPj len=0 
' 0018     27 LABEL : Cell Value, String Constant - DcQaxrHJQVMI len=0 
' 0018     25 LABEL : Cell Value, String Constant - EaDLVUuNiv len=0 
' 0018     25 LABEL : Cell Value, String Constant - EOLTLJafzw len=0 
' 0018     26 LABEL : Cell Value, String Constant - gMkdjIPKMlF len=0 
' 0018     23 LABEL : Cell Value, String Constant - GOogdvCS len=0 
' 0018     22 LABEL : Cell Value, String Constant - gueAjgE len=0 
' 0018     24 LABEL : Cell Value, String Constant - gUSunbtsA len=0 
' 0018     22 LABEL : Cell Value, String Constant - hVhtTjD len=0 
' 0018     23 LABEL : Cell Value, String Constant - KLiCkLiY len=0 
' 0018     24 LABEL : Cell Value, String Constant - KlVXBjmde len=0 
' 0018     21 LABEL : Cell Value, String Constant - KrWTuj len=0 
' 0018     26 LABEL : Cell Value, String Constant - qTmWWfvZMed len=0 
' 0018     21 LABEL : Cell Value, String Constant - RbfxJL len=0 
' 0018     24 LABEL : Cell Value, String Constant - RSiRMCdpB len=0 
' 0018     23 LABEL : Cell Value, String Constant - siCWqTKr len=0 
' 0018     25 LABEL : Cell Value, String Constant - xlUNqNYHZM len=0 
' 0018     21 LABEL : Cell Value, String Constant - zgOBbL len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.