Office (OLE) / .XLS malware analysis — malicious · 76b1f143a22d05c2

MALICIOUS

Office (OLE) / .XLS

102.0 KB Created: 2023-02-15 08:48:58 Authoring application: Microsoft Excel First seen: 2023-02-16

MD5: db87490022bf9f6828daa7017f497bdc SHA-1: 268aaf2f1b14a5342d37334ec2e339fb808ea6ff SHA-256: 76b1f143a22d05c24f84d404ea4d170210d0f7fa6b855b77b390d947161c93d4

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.001 PowerShell

The VBA macros contain critical heuristic firings for URLDownloadToFile and Shell() calls, indicating the sample's intent to download and execute a payload. The script constructs a path for the downloaded file using Environ$("USERPROFILE") and a random number, saving it to the Documents folder as a .raw file. The use of URLDownloadToFile and Shell() strongly suggests a downloader or droppper functionality.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dbb512f6efb57a79eca75ed7d4104342024e7e0f158f69323d6a81ce340d82c4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.