MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is an Excel file containing Excel 4.0 (XLM) macros, indicated by the OLE_XLM_AUTOOPEN and OLE_XLM_DANGEROUS_FN heuristic firings. The presence of an Auto_Open defined name suggests that the macro is designed to execute automatically when the workbook is opened. The dangerous formula APIs, specifically 'RUN', point towards the execution of external commands or payloads. This indicates a likely attack pattern of a malicious attachment delivered via spearphishing, intended to download and execute a secondary stage.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 6650 bytes |
SHA-256: 8204d51efe9f7400764736f199688eb12de73260596ab50bed83912ec33864c8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - huMTBe ' 0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d Sheet!D131 ' 0018 20 LABEL : Cell Value, String Constant - EqAuc len=0 ' 0018 23 LABEL : Cell Value, String Constant - gfkYyYOK len=0 ' 0018 21 LABEL : Cell Value, String Constant - gMSSYE len=0 ' 0018 21 LABEL : Cell Value, String Constant - iVmZCk len=0 ' 0018 24 LABEL : Cell Value, String Constant - IwqdRGGZw len=0 ' 0018 20 LABEL : Cell Value, String Constant - juHwF len=0 ' 0018 27 LABEL : Cell Value, String Constant - kEBSFCMCgMRh len=0 ' 0018 23 LABEL : Cell Value, String Constant - LHQkhgDy len=0 ' 0018 21 LABEL : Cell Value, String Constant - ojasHB len=0 ' 0018 22 LABEL : Cell Value, String Constant - oKwCirh len=0 ' 0018 24 LABEL : Cell Value, String Constant - PBCTAohoZ len=0 ' 0018 24 LABEL : Cell Value, String Constant - PVBPrrwdG len=0 ' 0018 23 LABEL : Cell Value, String Constant - RVjurklK len=0 ' 0018 26 LABEL : Cell Value, String Constant - UnXYoAneIzi len=0 ' 0018 23 LABEL : Cell Value, String Constant - uplOIidb len=0 ' 0018 26 LABEL : Cell Value, String Constant - WLfgcCpZHKi len=0 ' 0018 27 LABEL : Cell Value, String Constant - WyWetyuqrieD len=0 ' 0018 25 LABEL : Cell Value, String Constant - xWxfqDvwxs len=0 ' 0018 22 LABEL : Cell Value, String Constant - ymfPsGT len=0 ' 0018 20 LABEL : Cell Value, String Constant - yokCk len=0 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABE ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.