Malicious Office (OLE) / .XLS — malware analysis report

Heuristics 10

• Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
  OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is related Office object-delivery evidence when paired with exploit payload anomalies, but the malformed graphics record required for exact CVE attribution is not proven by this rule alone.
• ClamAV: Xls.Malware.Valyria-9756472-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Malware.Valyria-9756472-0
• VBA macros detected medium 5 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
  Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  Matched line in script

      Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

      Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")

• Payload URL assembled from a Chr()/Asc() string expression (1 URL) high OLE_VBA_EXPR_DROPPER_URL
  A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Sub Workbook_Open()

• Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
  Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://maps.googleapis.com/maps/api/distancematrix/json?origins= Referenced by macro

  • http://maps.googleapis.com/maps/api/distancematrix/json?origins=&destinations=&mode=car&language=en&sensor=false&key=YOUR_KEYReferenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.