Office (OLE) / .XLS malware analysis — malicious · 72edf3e38bcf1ce6

MALICIOUS

Office (OLE) / .XLS

75.0 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel

MD5: 0b217a2658b573448fe252922a809a7f SHA-1: 7f3e0ec97952850a600ab31bf0201b78e4bb1b4d SHA-256: 72edf3e38bcf1ce6aa19e43843ccb1198246fd7d1c08f2d5de0da8b6f1edad06

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel XLS document containing both VBA and Excel 4.0 macros. The Auto_Open VBA macro triggers the execution of an Excel 4.0 macro. The Excel 4.0 macro constructs and executes a PowerShell command to download a file named 'ft.exe' from the URL 'https://rb.gy/6dbqsw'. It then attempts to move the downloaded file to the user's AppData directory and execute it. This indicates a downloader or droppper functionality.

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `57bdc7a6741b03104561a2da2866ba4ff3197fd7994a4aa2dcb954996c0a5f96`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1256 bytes
`macros.bas` `fee65a11429dc10585813f204465c30b1b3c2131639dcde641611baba3f7538f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	830 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.