Office (OLE) / .XLS malware analysis — malicious · 7ca8e3203488d6cd

MALICIOUS

Office (OLE) / .XLS

95.5 KB Created: 2023-02-22 08:28:02 Authoring application: Microsoft Excel First seen: 2023-02-22

MD5: 6b6b50ca5bb99da5de056071b6b269b8 SHA-1: 46c06ae8c47e880030b174569b36426d03552e9f SHA-256: 7ca8e3203488d6cd7202f6a01f119fb7e8a80cbee58269ed4748bd2a9ba06402

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The VBA macros contain calls to URLDownloadToFileA and CreateObject("MsXMl2.xMLHTTp"), indicating an intent to download and execute a second-stage payload. The Shell() call further suggests execution of downloaded content. The document body 'GLS-Italy' and the authoring application 'Microsoft Excel' provide minimal context, but the core functionality is driven by the macro.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `a09357c399eeb5460e7ad06dfeddfd7c1ab4ed8b36fad9943f5d41244ba2275c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.