Office (OLE) / .XLS malware analysis — malicious · 8d93e4f39609f322

MALICIOUS

Office (OLE) / .XLS

64.5 KB Created: 2018-12-06 20:43:11 First seen: 2022-08-15

MD5: a32124ec7eb46ce08cb0ba7b00f6bdad SHA-1: 5247d300ce105fe365f18815c4c958da1c02fdc2 SHA-256: 8d93e4f39609f32227f91c1c2578e3c51eb3b1e15c4343b42116f03299cf3531

320 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1105 Ingress Tool Transfer T1204.002 Malicious File

The critical heuristic firings for OLE_VBA_SHELL, OLE_VBA_WSCRIPT, and OLE_VBA_HTTP_DROP_EXEC indicate that the VBA macros within this Excel file are designed to execute commands via WScript.Shell and download a secondary payload from a remote location. The Workbook_Open macro is likely responsible for initiating this malicious chain of events upon opening the document.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8af73501712fae59d23b2a6ae0f53bf1cbd0b6d27d7efa187ac4219c41467b44`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13278 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.