MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The file contains Excel 4.0 macros, including an Auto_Open entry, which is a strong indicator of malicious intent. The macros are designed to execute a PowerShell command that bypasses execution policies and downloads a second-stage payload from a remote source. This is further supported by heuristics indicating suspicious cmd.exe and PowerShell invocations.
Heuristics 5
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
Suspicious cmd.exe invocation with execution flag high SC_STR_CMDSuspicious cmd.exe invocation with execution flag
-
Reference to PowerShell high SC_STR_POWERSHELLReference to PowerShell
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 1858 bytes |
SHA-256: d56faaf7b0247fccc1fd6d054405edce433c858c7ef617976ff8cd21ff9a46fc |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - Macro ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0018 27 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=11 ptgArea3d *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x00\x00\x00\x00\x00\x00\xff\x00' ' 0018 73 LABEL : Cell Value, String Constant - cJgK²YLQfnWf9XNyvTnL°TvtKzL°lMTuWBhEXyQYCJ¤µh³Is¤tP3PoHb³N len=0 ' 0018 70 LABEL : Cell Value, String Constant - cw9P¶Ts7p¤c°y¤jbLZI²vkzC0lRNnd8tUQ2Jnml9XNIN3D²uxhaY8rX len=0 ' 0018 56 LABEL : Cell Value, String Constant - EbMcYUMnwA³1q8wpPFYTq8Q5mmCYlJ4rF0k°IGmI9 len=0 ' 0018 23 LABEL : Cell Value, String Constant - ECicbTPC len=0 ' 0018 50 LABEL : Cell Value, String Constant - F8gcf6f²ojqTVZPOqi5kVsI¤4g2tdP¶Frjp len=0 ' 0018 59 LABEL : Cell Value, String Constant - H4efVuvgLz7CcVfxQgfqLHh¤dJMye86Rm4Y²HmRQsµJU len=0 ' 0018 32 LABEL : Cell Value, String Constant - jj1hHcwHRRnqpx77z len=0 ' 0018 33 LABEL : Cell Value, String Constant - la°3pLHGuh2UZoG2At len=0 ' 0018 35 LABEL : Cell Value, String Constant - lWV¤O³¤4hNPL¤39zp2J3 len=0 ' 0018 39 LABEL : Cell Value, String Constant - qB3aAlcO1s°bTPSi89D³aHnM len=0 ' 0018 36 LABEL : Cell Value, String Constant - rCRVM6szIhvFMjNCIiCZ1 len=0 ' 0018 26 LABEL : Cell Value, String Constant - SK9LxPphxlB len=0 ' 0018 28 LABEL : Cell Value, String Constant - T¶Iv4G3ylmsxg len=0 ' 0018 73 LABEL : Cell Value, String Constant - uµ²Xd2kwTxmbBNX7frC²KHHeq³GNm7fCfK8SgNtVdYemN2KlQ°NVg3²FY³ len=0 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' Macro,A1,[],"" ' Macro,A2,RETURN(),"" |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.