Office (OLE) / .XLS malware analysis — malicious · 8464e28250faf8cc

MALICIOUS

Office (OLE) / .XLS

192.0 KB Created: 2018-12-06 20:43:11 Authoring application: Microsoft Excel

MD5: 4b5efde48442f60d1563164c1e728061 SHA-1: f371b6ea0311f9175c78102e3a087ab5fc7fe687 SHA-256: 8464e28250faf8cc3d316329b9b39cbc029659d93db9da3086ce9fc5e37bbcd1

340 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The file is an XLS spreadsheet containing VBA macros. The Workbook_Open event is configured to execute a Shell() call using WScript.Shell. This indicates the macro is designed to run arbitrary commands, likely to download and execute a second-stage payload. No specific family could be identified, but the technique is common for initial access.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1a622049cf6b8a5ecab6ae349119cc621b51e94f5609cfb9bf7d62a08c9a028c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7610 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.