Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 828bbb1a2684f7c4…

MALICIOUS

Office (OLE) / .XLS

525.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2021-05-26
MD5: dc909f5ee57b0c86669f7e957b02b40c SHA-1: 9d6b3fd1c72451b779218bce3d38b38bde2d729c SHA-256: 828bbb1a2684f7c44e234536f8df7df4f0fa54a4cd9b44e07994eb11244c249e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is an Excel 4.0 macro sheet (XLM) that uses an 'enable content' lure to trick the user into executing its payload. The macro sheet contains embedded URLs that are likely used to download and execute a second-stage payload via rundll32.exe or regsvr32.exe. The XLM macro itself is obfuscated, but the presence of the Auto_Open payload lure and the embedded URLs strongly indicate a downloader or droppper functionality.

Heuristics 4

  • XLM Auto_Open workbook with payload URL or enable-content lure critical OLE_XLM_AUTOOPEN_PAYLOAD_LURE
    Workbook contains an Excel 4.0 macro sheet with Auto_Open / Auto_Close and also exposes a payload URL or enable-content lure in the OLE bytes. This combination is a high-confidence XLM downloader/social-engineering pattern even when formula recovery cannot decode the full macro chain.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://aravindanavada.com/AHt5r3T0VSlq/solo.html In document text (OLE body)
    • https://mrcrgroup.com/sOyQynNJYBY/solo.htmlIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.