Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 a6e439d10a521e60…

MALICIOUS

Office (OLE) / .XLS

34.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-08-03
MD5: 46584407836c832a1b9b72225c6494a0 SHA-1: 4c46b983bc33aeb430daae36dc0ef0a8958db006 SHA-256: a6e439d10a521e60b7e18f6a43e59049399ce3421009910c30ae7076384b3c29
580 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer T1059.001 PowerShell T1204.002 Malicious File

The Workbook_Open and Auto_Close macros trigger the execution of a cmd.exe command. This command copies a file named 'quietmoth.exe' from a network share '\\10.127.252.11\share\quietmoth.exe' to 'C:\Windows\Tasks\quietmoth.exe' and then executes it. Additionally, the Auto_Close macro in Sheet1 uses URLDownloadToFileA to download 'quietmoth.exe' from '\\10.127.252.11\SHARE\quietmoth.exe' to the startup folder.

Heuristics 13

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f8c9e80e5fd620811656dc6cfeddd4e16a43b35738779d9b1b05200904943054		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.