Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6adad358f75f907c…

MALICIOUS

Office (OLE)

2.29 MB Created: 2006-02-14 17:35:43 Authoring application: Microsoft Excel
MD5: 2dc8c48bbfb4f6ba84f5daeb50b84f47 SHA-1: 34804525feea50b50d416243fa855626dc82b5b7 SHA-256: 6adad358f75f907caa22dd001d94f921b59f173cc55cd0d672d2864e279283a0
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

This Excel document contains heavily obfuscated VBA macros, including a Workbook_Open auto-execution routine. The macros utilize CreateObject and WinExec API calls, indicating an intent to execute arbitrary code. The presence of UNC paths and filenames suggests the macro may be involved in downloading or updating components from a network share.

Heuristics 6

  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
01242f75aef4fe5b256f190a4f0902887a766afb83ff6dad9a5e6fba1a3fb404		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 440350 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.