Office (OLE) / .XLS malware analysis — malicious · 929d0f0a340a8dce

MALICIOUS

Office (OLE) / .XLS

168.0 KB Created: 2021-04-13 13:37:17 Authoring application: Microsoft Excel

MD5: 383f9360a7603ea4f72017af513874be SHA-1: af692859b3f90ace0db79cdd34e1affecadae875 SHA-256: 929d0f0a340a8dcebde8b92b6794b0651006e319e087984d5451b8e9424a353a

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The Workbook_Open macro executes a PowerShell command that downloads a second-stage executable from 'http://3.64.251.139/v11/1/TDH_0117607520026IMG.exe' and saves it as 'C:\Users\Public\Documents\suggeststock.exe'. The macro also writes this command to 'C:\Users\Public\Documents\partnerlow.cmd' and then uses GetObject to execute the cmd file. This indicates a downloader pattern.

Heuristics 4

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `74959936ef1d059f366e730124e43f809ac6a5c1e70d9d8ef09493eacb57b66c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1353 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.