Office (OLE) / .XLS malware analysis — malicious · 8b871bd68099a3a9

MALICIOUS

Office (OLE) / .XLS

49.5 KB Created: 2023-02-15 08:34:34 First seen: 2023-02-16

MD5: f1d5afc15f5010fbc9cb0db00e979218 SHA-1: 5bfd2adbb77c5cfce6257608530d0e02136c593f SHA-256: 8b871bd68099a3a9fe0715506d4669e166f3a3f863f2d5c2130978a7dee38b35

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.001 PowerShell

The sample contains VBA macros that leverage the URLDownloadToFile API to download a file. The script also uses CreateObject("MSXML2.XMLHTTP") and Environ$("USERPROFILE") to construct a path for the downloaded file, likely to execute a second-stage payload. The presence of Shell() and CreateObject calls, along with URLDownloadToFile, strongly indicates a downloader functionality.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dc3658fd66592ed96c3ce0b88ecb5eac986b61459a9a82d3806c84f27bfa81c6`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2235 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.