Office (OLE) / .XLS malware analysis — malicious · a21429658d91a1fd

MALICIOUS

Office (OLE) / .XLS

85.5 KB Created: 2022-08-09 12:53:26 Authoring application: Microsoft Excel First seen: 2022-08-09

MD5: 9908b92784cad52c9287e64e08ec1267 SHA-1: c381a90c5a5ab0cd17c23557ebdccd6019201944 SHA-256: a21429658d91a1fd43c2e88620ef2af1a05ea074a310a6f23b2960115a1e1a1d

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical heuristic OLE_VBA_HTTP_DROP_EXEC indicates that the VBA macros download a file from an HTTP URL and write it to disk. The script contains obfuscated functions that likely facilitate this download and execution process. The specific URL 'http://192.168.1.100/payload.exe' was identified as the source of the payload.

Heuristics 4

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `acefd2966d92925b969b922b2e0b5939e198048af7b6616b0a41367b29b35c50`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3887 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.