Office (OLE) / .XLS malware analysis — malicious · a0ed980290470767

MALICIOUS

Office (OLE) / .XLS

409.0 KB Created: 2016-11-08 08:33:09 Authoring application: Microsoft Excel First seen: 2022-08-01

MD5: 9521bb7a1cd04c45207878e34b08287d SHA-1: a09ec93e79bf36f1889d97464e25609233e86931 SHA-256: a0ed980290470767b33ed702a4eb7d8f5aecea197e71ed58788916127af42bcb

228 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1059.003 Windows Command Shell T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File

The VBA script within the Excel file utilizes WScript.Shell and CreateObject to decode a Base64 encoded string, which is then written to the temporary directory as 'nvidiax.exe'. This executable is likely a second-stage payload. The document body, though partially in Persian, appears to be a form for an 'offer', suggesting a social engineering lure.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `54ba713ab254cfd6176a4b8846c3b0962e2e7a2f34b5c1107ba20bf283bf1595`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7094 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.