Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 95e61ca14776b3ad…

MALICIOUS

Office (OLE) / .XLS

62.0 KB Created: 2020-03-16 10:31:10 Authoring application: Microsoft Excel
MD5: be5e3f8ab34c845abfa4206e612e62fa SHA-1: 5e31a124cee0bb42d9b64236ec0345fd2d5ff8b1 SHA-256: 95e61ca14776b3ad492440a9b0ed811d6ec1d1e09e8ab3611d48c3fb6f61bce4
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is an Excel spreadsheet containing VBA macros that utilize WScript.Shell and CreateObject, indicating an attempt to execute arbitrary code. The ClamAV detection 'Doc.Dropper.Agent-7627469-0' strongly suggests its role as a dropper. The document body text is garbled and truncated, providing no clear user-facing lure, but the presence of shell execution calls points to a payload delivery mechanism.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Doc.Dropper.Agent-7627469-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7627469-0
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a36866386f036d78c52aa03e9ca045a2524106675d36f9ef8770442d7343cc51		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1638 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.