Office (OLE) / .XLSX malware analysis — malicious · 886aaecb9e0da6dc

MALICIOUS

Office (OLE) / .XLSX

171.5 KB Created: 2019-06-03 07:04:22 Authoring application: Microsoft Excel First seen: 2023-02-06

MD5: 5e575d8fdc92f66bfb75afe60fc5f6de SHA-1: be6df91f4d94cc7c9b34867590fc03ecc0f44dd2 SHA-256: 886aaecb9e0da6dc0a8e1b5b7ef6ffebd73289befac0da86d17fe4cf3ca17a4c

160 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic

The sample is an Excel spreadsheet containing VBA macros, including Auto_Open and Auto_Close functions, which are commonly used for malicious purposes. The Auto_Open macro attempts to establish persistence by saving a copy of the workbook to the Excel startup folder as 'mypersonel.xls' or 'mypersonnel.xls'. The Auto_Close macro then attempts to disguise its presence by converting the workbook to an older XLS format and deleting the original XLSX file. The presence of these macros and persistence mechanisms strongly suggests malicious intent.

Heuristics 4

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d49b3eed57ea333340314eacd5bf3454f6a2ba3085f3bfa723034dd1a2d97cfb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1510 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.