Office (OLE) / .XLS malware analysis — malicious · 895a890a1ab4daf5

MALICIOUS

Office (OLE) / .XLS

86.0 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel

MD5: 65d36a5399f81c9547d5a3aaad15ac1e SHA-1: 5911215630c0b08bcd61ef36df08fd007dfc765c SHA-256: 895a890a1ab4daf5dfbad2449167f317d0393e45d7d38e34216cd703b04de692

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an Excel 4.0 macro-enabled spreadsheet. The Auto_Open macro and XLM macros are configured to execute a PowerShell command that downloads a file named 'sw.exe' from 'https://tinyurl.com/y5dsc4ag' and then executes it from the user's AppData directory. This indicates a downloader or droppper functionality.

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `b6b7904e2371a175e7f6829ebbc84e498d3a74199bcbd73a7267723ca77c6b6e`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1427 bytes
`macros.bas` `c14dd6d2332aec42601f638d9220a7d42954f10b6b83884a1c68d4a74f82d1bb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.