Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 9b8516fcbe183de0…

MALICIOUS

Office (OLE) / .XLS

153.0 KB Created: 2020-04-23 12:26:24 Authoring application: Microsoft Excel
MD5: 44b43922e08e0e8e1ec65300b3b1aa74 SHA-1: ec1a847009295036381af1b0a4383a61c3dcbb75 SHA-256: 9b8516fcbe183de0a53ac47ea7f4289176e23fc82da1fe67c70cedc823f5dba6
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1204.002 Malicious File T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample is an Excel 4.0 macro-enabled spreadsheet containing multiple macro sheets. It references the URLDownloadToFile API, indicating it will download a file from a remote server. The document body presents a deceptive prompt to the user, urging them to enable content for decryption, which is a common lure for macro-based malware. The embedded URLs are highly suspicious and likely serve as the source for the malicious payload. The presence of ShellExecute API calls further suggests the execution of downloaded content.

Heuristics 5

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • OLE metadata lists many Excel 4.0 macro sheets medium OLE_XLM_DOCPROPS_MACROSHEET_INVENTORY
    Workbook contains a BIFF Excel 4.0 macro-sheet marker and its clear OLE DocumentSummaryInformation stream lists many MacroN sheet titles. This is a useful static signal when FILEPASS encryption prevents formula extraction from the workbook stream.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
    • https://rnollg.com/kev/scfrd.dll$8
    • http://wmwifbajxxbcxmucxmlc.com/files/april24.dll

Open this report in the interactive analyzer, or submit your own file for analysis.