Office (OLE) / .XLS malware analysis — malicious · 9d300d9ddd8b35a3

MALICIOUS

Office (OLE) / .XLS

185.0 KB Created: 2018-10-11 16:13:15 First seen: 2022-07-26

MD5: cf7a8114b0783bed77838f9d113a7efc SHA-1: 75bc8d93d218726c7d8c926f4c5100e4ae625758 SHA-256: 9d300d9ddd8b35a36dafc4f2d2b33a2a65b840e7e433f2c42d79b18c73ceb7b3

288 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The critical heuristic OLE_VBA_HTTP_DROP_EXEC indicates that the VBA macros download and save a file to disk, while OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER suggests an obfuscated loader designed to execute automatically. The Workbook_Open heuristic confirms this execution trigger. The ClamAV detection provides a specific identifier for the detected malware family.

Heuristics 7

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
ClamAV: Xls.Malware.Emodldr-10058834-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Emodldr-10058834-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1d999f8916f71d7e389978b24b254f495e98af5f54b0298d819a679121519af9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	190279 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.