Office (OLE) / .XLS malware analysis — malicious · 8e24a5b9abf4c574

MALICIOUS

Office (OLE) / .XLS

839.5 KB Created: 2021-05-19 13:32:38 Authoring application: Microsoft Excel

MD5: f9288646e623a8a8f0fa5ff5f6b5e3d6 SHA-1: fa69d65f9f67ba4dcfb359efd8ecfe3a0ba16719 SHA-256: 8e24a5b9abf4c574033fa2710942dd9eda4b3ce37855379a9c26a08d292e3efb

290 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The file contains a Workbook_Open macro that utilizes WScript.Shell and CreateObject, indicating it's designed to execute commands. The presence of numerous suspicious URLs suggests a downloader or droppper functionality. No document body text was available for analysis, but the script behavior strongly implies a malicious payload delivery.

Heuristics 9

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL https://marbiadesign.com/css/fonts/INVRhwduUaFS.php
- https://langgal.coop.np/0KafeflIy.php
- https://specs2go.shawalzahid.com/wp-includes/sodium_compat/src/Core/Base64/gRC1QXli.php
- https://langgal.coop.np/0KafeflIy.phpW
- https://specs2go.shawalzahid.com/wp-includes/sodium_compat/src/Core/Base64/gRC1QXli.php3
- https://fotounirii.ro/wp-content/plugins/under-construction-page/themes/000webhost/EYZWDFGxTaDjbR.phpEdIa
- https://pratikmetals.com/system/database/drivers/pdo/subdrivers/FVTsLgQ1vriNlv.phpSUT,(a4Upa
- https://greystonestructural.com/1y3dVMa45GFqjA.php|,H8Cd�
- https://welcometotheafterdeath.com/pixelmonkey.com.au/saeadventures/wp-includes/Text/Diff/0hDhEI2E.php.QP+d�
- https://superbeli.com/fMn3tApyS5wbJU.phphPG^+�
- https://iminnovator.com/index_files/yVoSMJ3GBq7lzW5.php�
- https://lojamusic.com.br/lojamusic.com.br/sitebuilder/IWu1s3chQoaXq.php|+=rp|+=rp|+=rp�
- https://greystonestructural.com/1y3dVMa45GFqjA.php|,H8Cd
- https://welcometotheafterdeath.com/pixelmonkey.com.au/saeadventures/wp-includes/Text/Diff/0hDhEI2E.php.QP+d
- https://superbeli.com/fMn3tApyS5wbJU.phphPG^+
- https://iminnovator.com/index_files/yVoSMJ3GBq7lzW5.php
- https://lojamusic.com.br/lojamusic.com.br/sitebuilder/IWu1s3chQoaXq.php|+=rp|+=rp|+=rp

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e9fda14557854e64c660b6ee497f20b5a315845c7746867e1dcd06f9873015b3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1005441 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.