Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 9eaa499aa4a1bc64…

MALICIOUS

Office (OLE) / .XLS

79.5 KB Created: 2021-10-08 09:36:50 Authoring application: Microsoft Excel
MD5: 50b0532fb46b59495f1157391722cbbc SHA-1: 79bcfe97656e6dd85e69d43144459b555fb29db6 SHA-256: 9eaa499aa4a1bc644d2a9696f87a2e75c50c64da1ad52837db4e15659b7fd17f
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is an Excel spreadsheet containing a VBA macro that executes embedded JavaScript using ScriptControl. The Auto_Open macro is present, indicating that the script will run automatically when the document is opened. The script's intent is to download and execute a second-stage payload, as indicated by the use of ScriptControl and the heuristic firings related to macro execution and potential exploits. The specific JavaScript code is not fully provided, but the overall mechanism points to a downloader.

Heuristics 6

  • MSScriptControl.ScriptControl — CVE-2015-0097 high CVE likely CVE_2015_0097_SC
    MSScriptControl.ScriptControl — CVE-2015-0097
  • ClamAV: Xls.Downloader.MirrorBlast-f8f807074fc98734-9955046-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.MirrorBlast-f8f807074fc98734-9955046-0
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
2b80cbb1cb43330108f2ee3263fd4ffc507fc998f76a1c9088fb2c1b01e1d25f		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2038 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.