Office (OLE) / .XLS malware analysis — malicious · 77d1b49f30ebc6e2

MALICIOUS

Office (OLE) / .XLS

71.5 KB Created: 2021-11-17 02:06:11 Authoring application: Microsoft Excel

MD5: 448d82a83a56ba75830d64508f97b52f SHA-1: 14e1066f81f55c3ffbca700f094d91053031deca SHA-256: 77d1b49f30ebc6e276dccbe98212da52a3030e04cc8b0caac11e2ebac7b6a66e

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The Workbook_Open macro executes a PowerShell command that downloads a second-stage executable from 'http://ddl8.data.hu/get/251388/13126736/jogc.exe' and saves it as 'C:\Users\Public\Documents\himselfcontain.exe'. The macro also attempts to open a file named 'C:\Users\Public\dssdd.cmzd' using explorer, which likely serves as a lure or a way to trigger the execution of the downloaded payload.

Heuristics 5

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4b2d1f6a4f01a05536456c222d9fd599c9a25934aa19adb62c660b7e239bfed8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1892 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.