Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 75ab03676abd8f33…

MALICIOUS

Office (OLE)

113.5 KB Created: 2019-06-16 06:27:00 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: db2aeb3ec052b3b36ad70e478b3b5070 SHA-1: 5ec5f1e6e41e37b3658b825a2df561f894190a0b SHA-256: 75ab03676abd8f333abbacec3d9b0ea6ede444521aa998bf57612d46e69d04cb
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel 4.0 macro-enabled workbook containing an Auto_Open macro, which is a critical finding. The document body displays a "DOCUMENT PROTECTED!" lure, instructing the user to "Enable Editing" and "Enable Content", typical for macro-based attacks. The presence of the Auto_Open macro indicates the intent to execute arbitrary code upon opening the workbook.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 53461 bytes
SHA-256: ef9d0de0c6e408b819ceba311cda6aab2703d6cf57b41a40105e003a2cb86404
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     26 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  HPwH6tRSfvPZguyGT
' 0018     19 LABEL : Cell Value, String Constant - aCHT len=0 
' 0018     21 LABEL : Cell Value, String Constant - ACPnDD len=0 
' 0018     34 LABEL : Cell Value, String Constant -          hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xf0$\x1b%+\x00+\x00'
' 0018     18 LABEL : Cell Value, String Constant - agI len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!GR51070 
' 0018     18 LABEL : Cell Value, String Constant - BjD len=0 
' 0018     20 LABEL : Cell Value, String Constant - CHWyS len=0 
' 0018     18 LABEL : Cell Value, String Constant - DjG len=0 
' 0018     18 LABEL : Cell Value, String Constant - DLh len=0 
' 0018     19 LABEL : Cell Value, String Constant - dWME len=0 
' 0018     21 LABEL : Cell Value, String Constant - EazhbH len=0 
' 0018     20 LABEL : Cell Value, String Constant - eHJmS len=0 
' 0018     19 LABEL : Cell Value, String Constant - eIkD len=0 
' 0018     21 LABEL : Cell Value, String Constant - eQMIrg len=0 
' 0018     18 LABEL : Cell Value, String Constant - FCF len=0 
' 0018     18 LABEL : Cell Value, String Constant - FIa len=0 
' 0018     21 LABEL : Cell Value, String Constant - FmaEmM len=0 
' 0018     19 LABEL : Cell Value, String Constant - frwN len=0 
' 0018     18 LABEL : Cell Value, String Constant - fwG len=0 
' 0018     18 LABEL : Cell Value, String Constant - gLA len=0 
' 0018     33 LABEL : Cell Value, String Constant -         hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xce\x8a\x1e\x8b\x04\x00\x04\x00'
' 0018     21 LABEL : Cell Value, String Constant - gsKiQJ len=0 
' 0018     19 LABEL : Cell Value, String Constant - GTie len=0 
' 0018     21 LABEL : Cell Value, String Constant - HHMeQG len=0 
' 0018     18 LABEL : Cell Value, String Constant - HkT len=0 
' 0018     20 LABEL : Cell Value, String Constant - hpveG len=0 
' 0018     20 LABEL : Cell Value, String Constant - iGqqo len=0 
' 0018     20 LABEL : Cell Value, String Constant - iuFlT len=0 
' 0018     21 LABEL : Cell Value, String Constant - jHpaov len=0 
' 0018     20 LABEL : Cell Value, String Constant - JJzsW len=0 
' 0018     20 LABEL : Cell Value, String Constant - JuyiU len=0 
' 0018     18 LABEL : Cell Value, String Constant - JZy len=0 
' 0018     20 LABEL : Cell Value, String Constant - KBovM len=0 
' 0018     20 LABEL : Cell Value, String Constant - KWSjw len=0 
' 0018     20 LABEL : Cell Value, String Constant - lNMiO len=0 
' 0018     18 LABEL : Cell Value, String Constant - lRc len=0 
' 0018     19 LABEL : Cell Value, String Constant - lYrZ len=0 
' 0018     31 LABEL : Cell Value, String Constant - mMNYBnfIh hidden len=7 ptgRef3d  Sheet!GR51070 
' 0018     19 LABEL : Cell Value, String Constant - NdRq len=0 
' 0018     21 LABEL : Cell Value, String Constant - NeKchN len=0 
' 0018     19 LABEL : Cell Value, String Constant - NGJl len=0 
' 0018     18 LABEL : Cell Value, String Constant - Nqb len=0 
' 0018     21 LABEL : Cell Value, String Constant - NrEyhO len=0 
' 0018     18 LABEL : Cell Value, String Constant - ObD len=0 
' 0018     21 LABEL : Cell Value, String Constant - ODVERX len=0 
' 0018     19 LABEL : Cell Value, String Constant - pbcY len=0 
' 0018     18 LABEL : Cell Value, String Constant - Pgp len=0 
' 0018     20 LABEL : Cell Value, String Constant - pLEkr len=0 
' 0018     20 LABEL : Cell Value, String Constant - POBtT len=0 
' 0018     19 LABEL : Cell Value, String Constant - QLbm len=0 
' 0018     18 LABEL : Cell Value, String Constant - rbt len=0 
' 0018     18 LABEL : Cell Value, String Constant - rCb len=0 
' 0018     20 LABEL : Cell Value, String Constant - reLma len=0 
' 0018     20 LABEL : Cell Value, String Constant - rMfQw len=0 
' 0018     19 LABEL : Cell Value, String Constant - sHSJ len=0 
' 0018     20 LABEL : Cell Value, Strin
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.