Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 81ac181ca1ad9b7c…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:43:49 Authoring application: Microsoft Excel First seen: 2021-09-29
MD5: 6f5258495e86d62ddf652f9f8a20f3f5 SHA-1: 9eb4a03a046dec01c6aae2caa8e8ea88de5f36a3 SHA-256: 81ac181ca1ad9b7cdae791faa4ec6d5cd8168cdd22dc9e3272e204ce408a0f77
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open macro, which is a known technique for executing malicious code upon opening the workbook. The presence of dangerous formula APIs like RUN indicates an intent to execute external commands or download payloads. While no specific URLs or hashes were extracted, the Auto_Open macro itself is a critical indicator of malicious intent.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6694 bytes
SHA-256: 46d726dd42670000c59a373069a50e7593625ebf0930925e5df30636df2ec8e3
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  oymciWClaCz
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!F172 
' 0018     27 LABEL : Cell Value, String Constant - CeuPljfOTEKQ len=0 
' 0018     27 LABEL : Cell Value, String Constant - gCGFjyeOpJGK len=0 
' 0018     25 LABEL : Cell Value, String Constant - gZTswSQkMy len=0 
' 0018     25 LABEL : Cell Value, String Constant - htVSiAZxWD len=0 
' 0018     21 LABEL : Cell Value, String Constant - kLTSug len=0 
' 0018     22 LABEL : Cell Value, String Constant - LtPdzFe len=0 
' 0018     27 LABEL : Cell Value, String Constant - lyTscfRAJqlj len=0 
' 0018     27 LABEL : Cell Value, String Constant - MwxIlbGZkfoz len=0 
' 0018     20 LABEL : Cell Value, String Constant - NIhCv len=0 
' 0018     22 LABEL : Cell Value, String Constant - nLyKXFr len=0 
' 0018     27 LABEL : Cell Value, String Constant - oqliRhXeENwu len=0 
' 0018     22 LABEL : Cell Value, String Constant - OzpCvpa len=0 
' 0018     21 LABEL : Cell Value, String Constant - rjEXRm len=0 
' 0018     25 LABEL : Cell Value, String Constant - tbTzxOpOJC len=0 
' 0018     24 LABEL : Cell Value, String Constant - tjtxQbqDf len=0 
' 0018     24 LABEL : Cell Value, String Constant - tXnpaPCgL len=0 
' 0018     24 LABEL : Cell Value, String Constant - VnfqFhALd len=0 
' 0018     21 LABEL : Cell Value, String Constant - ZTTlHs len=0 
' 0018     27 LABEL : Cell Value, String Constant - ZycpUcqhBTTE len=0 
' 0018     26 LABEL : Cell Value, String Constant - zyieMuZxQxB len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Const
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.