Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8944195de3717a36…

MALICIOUS

Office (OLE) / .XLS

367.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel
MD5: 3e2782345ea7613207757309fa8b497b SHA-1: e1a5a5d24c0e871ca89d928ecc21f33badc780d2 SHA-256: 8944195de3717a36760348b02949c77901a8fdabda650ac9fdd795af06fe7633
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Excel 4.0 workbook containing an Auto_Open macro, which is a common technique to bypass security warnings and prompt the user to enable content. The macro attempts to download a payload from one of two provided URLs, indicating a downloader or droppper functionality. The presence of an enable-content lure and the Auto_Open function strongly suggest a malicious intent.

Heuristics 5

  • XLM Auto_Open workbook with payload URL or enable-content lure critical OLE_XLM_AUTOOPEN_PAYLOAD_LURE
    Workbook contains an Excel 4.0 macro sheet with Auto_Open / Auto_Close and also exposes a payload URL or enable-content lure in the OLE bytes. This combination is a high-confidence XLM downloader/social-engineering pattern even when formula recovery cannot decode the full macro chain.
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mayread.com/aXfFF8qdsV/th.html In document text (OLE body)
    • https://tpcsv.neosj.why3s.tw/XjHoDakG/th.htmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
7758cbebef832a37ce0a327fd7d893202195f03ba9b854edef74b19dbb11678f		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 8349 bytes
Preview script
First 1,000 lines of the extracted script
' 0085     11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Doc1
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Doc2
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Doc3
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Doc4
' 0085     11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Doc5
' 0018     31 LABEL : Cell Value, String Constant - _xlfn.AGGREGATE hidden len=2 ptgErr  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1d'
' 0018     30 LABEL : Cell Value, String Constant - _xlfn.F.INV.RT hidden len=2 ptgErr  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1d'
' 0018     33 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=18 ptgRef3d 65535!A1 *UNKNOWN TOKEN* 0x0000 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x01\x00\x04\x00\x04\x00\x06\x00,'
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 0204     19 LABEL : Cell Value, String Constant
' 0204     19 LABEL : Cell Value, String Constant
' 0204      9 LABEL : Cell Value, String Constant
' 0204     10 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204      9 LABEL : Cell Value, String Constant
' 0204     10 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204     10 LABEL : Cell Value, String Constant
' 0204     12 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204     12 LABEL : Cell Value, String Constant
' 0204      9 LABEL : Cell Value, String Constant
' 0204     11 LABEL : Cell Value, String Constant
' 0204     10 LABEL : Cell Value, String Constant
' 0204     14 LABEL : Cell Value, String Constant
' 0204     24 LABEL : Cell Value, String Constant
' 0204     22 LABEL : Cell Value, String Constant
' 0204     10 LABEL : Cell Value, String Constant
' 0204     14 LABEL : Cell Value, String Constant
' 0204     23 LABEL : Cell Value, String Constant
' 0204     30 LABEL : Cell Value, String Constant
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
' Doc2,BJ15,65534!A1,""
' Doc3,BY23,HALT(),""
' Doc3,CF26,"",0.00000000000000000000
' Doc3,CB30,"",3.00000000000000000000
' Doc4,BM8,"['MDETERM(56241452475.00000000000000000000)', '65535!A1']",""
' Doc5,BS12,"['*STACKERROR* not enough arguments for function: RAND=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)', '452354.00000000000000000000=SUMXMY2(45245)', '65534!A1']",""
' Doc5,BS16,"['*STACKERROR* not enough arguments for function: RAND=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT(59)=RAND(452354.00000000000000000000=SUMXMY2(45245))=FACT
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.