Office (OLE) / .XLS malware analysis — malicious · 93c5aec3a5531518

MALICIOUS

Office (OLE) / .XLS

151.5 KB Created: 2021-07-29 19:03:34 Authoring application: Microsoft Excel First seen: 2022-08-10

MD5: ef16fd8dfcfee2afcc549fa5583f79e8 SHA-1: e6b740f4560294b9a3e5f02ee50e69058c5741f6 SHA-256: 93c5aec3a55315181bb4e744129feffaa206de3f93a8a8a40ba7821926c55001

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Service Execution: Service Execution T1204.002 Malicious File Execution: Malicious File

The file contains an Excel 4.0 macro sheet with an Auto_Open defined name, indicating automatic execution upon opening. The macro references PowerShell and includes a URL, suggesting it downloads and executes a second-stage payload. The presence of the URL http://179.43.175.187/zqde/Pgeboqi.exe is a high-priority indicator.

Heuristics 5

Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME

oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://179.43.175.187/zqde/Pgeboqi.exe

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `77526317693988808943c9b58a3ee3cfe53fc53006ec2ab7a604bb8c52dec5d0`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.