Malicious Office (OLE) / .XLS — malware analysis report

Heuristics 10

• Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
  Reference to URLDownloadToFile API
• VBA macros detected medium 5 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

      Set WshShell = CreateObject("WScript.Shell")

• VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
  VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  Matched line in script

  ¡¤¾¿´·¬§®µ³³²µ¤¡´¾¡¢¸²´¢½°¬¯¶¡»¶°¹¾µµ££½¬¥»¨»¦µ¼µ´¡»¹¨¼¬¨ª¤··«ª¥¹¢¿¦½®£³¤¿¼¼»¾¶²¶§¹ = ¹¨º£¬¯¹©¿º¬¦¾¾·¢¾£µ½²¼´·©¾½¹ª¬²¾¢²¡¶¸¯¢¡µ»¸¦´¿¤¸´£¯©©©§¿»¿³ºº«©¨¬³»·£®¬°®«£´¿§¯¸.responseBody

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

      Set WshShell = CreateObject("WScript.Shell")

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Private Sub Workbook_Open()

• Reference to ShellExecute API high SC_STR_SHELLEXEC
  Reference to ShellExecute API
• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Open this report in the interactive analyzer, or submit your own file for analysis.