Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 82a4afff3fbd4a7c…

MALICIOUS

Office (OLE) / .DOC

241.0 KB Created: 2020-04-17 06:37:08 Authoring application: Microsoft Excel
MD5: 2ffb3140e169d6331628e0f98495c454 SHA-1: 75c90fd8d6e98f66755aa38c4232aa7202b8c651 SHA-256: 82a4afff3fbd4a7cc4f464fd34f62c12eada46a5b635e774e578c9f32367094b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file containing Excel 4.0 macros, indicated by the OLE_XLM_AUTOOPEN heuristic. The OLE_XLM_DANGEROUS_FN heuristic specifically flags the use of the RUN function within the Auto_Open macro, which is highly suspicious. No document body text or external URLs were found to be malicious, and no scripts were extracted. The primary threat appears to be the embedded XLM macro itself, likely designed to execute arbitrary commands.

Heuristics 3

  • XLM Auto_Open with dangerous formula APIs high OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.microsoft.com/photo/1.0/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
56144ff25e7211e0d4cd66bb4d2c875aaba348a36ff36d8c089edd73199d335d		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 140278 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.