Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 b001d45c4cd80cc2…

MALICIOUS

Office (OLE) / .XLSX

180.5 KB Created: 2017-09-13 11:45:10 Authoring application: Microsoft Excel First seen: 2022-09-29
MD5: 2aa112177f00eb7dbe8c1b901de50dd6 SHA-1: e5941bee2a4561d02761127e7f72e3066e34c282 SHA-256: b001d45c4cd80cc2ecd1e4d98f9c2bcd0874fc8cec677acb957cbdc1075293c7
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a Workbook_Open macro that uses the Shell() function to execute PowerShell. The script attempts to download a payload using a heavily obfuscated PowerShell command. The presence of the Shell() call and the obfuscated PowerShell execution strongly indicate a downloader or initial access mechanism.

Heuristics 8

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sante.defense.gouv.fr/sismudoc/docsismu/20170518_NP_CETIMA-FORCES_ReP3SA-directives-installation-PC-LUMM-1.8.pdf---Gratuit
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Trend/produits/TMCM/6.0/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Trend/produits/Officescan/11/Francais/logiciel/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Trend/produits/Officescan/11/Francais/logiciel/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_Center/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_for_Windows_Entreprise_Edition/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_pour_MS_Exchange/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_pour_SharePoint_Server/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_for_Linux_File_Server/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Endpoint_Security/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_Enterprise_Console/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_autonome/http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_UTM/http://portail-dirisi.intradef.gouv.fr/sd-ssi/index.php/cyberprotection-securite-informatique/outils/13-ssi/169-ssi-darma-licence-personnelle-internet
    • http://portail-dirisi.intradef.gouv.fr/sd-ssi/index.php/cyberprotection-securite-informatique/outils/13-ssi/169-ssi-darma-licence-personnelle-internet
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Trend/produits/TMCM/6.0/`
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Trend/produits/Officescan/11/Francais/logiciel/^
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_Center/m
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_for_Windows_Entreprise_Edition/h
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_pour_MS_Exchange/n
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Security_pour_SharePoint_Server/d
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_for_Linux_File_Server/`
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Kaspersky/produits/Kaspersky_Endpoint_Security/[
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_Enterprise_Console/Q
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_autonome/L
    • http://decos-ln.intradef.gouv.fr/sdssi/antivirus/Sophos/Produits/Sophos_UTM/
    • http://www.sante.defense.gouv.fr/sismudoc/docsismu/20170518_NP_CETIMA-FORCES_ReP3SA-directives-installation-PC-LUMM-1.8.pdf
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/iX/1.0/
    • http://schemas.microsoft.com/office/2006/metadata/contentType
    • http://schemas.microsoft.com/office/2006/metadata/properties/metaAttributes
    • http://schemas.microsoft.com/office/2006/metadata/properties
    • http://www.w3.org/2001/XMLSchema
    • http://schemas.microsoft.com/sharepoint/v3/fields
    • http://schemas.microsoft.com/office/2006/documentManagement/types
    • http://schemas.microsoft.com/office/infopath/2007/PartnerControls
    • http://schemas.openxmlformats.org/package/2006/metadata/core-properties
    • http://www.w3.org/2001/XMLSchema-instance
    • http://purl.org/dc/terms/
    • http://schemas.microsoft.com/internal/obd
    • http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsd
    • http://dublincore.org/schemas/xmls/qdc/2003/04/02/dcterms.xsd
    • http://schemas.openxmlformats.org/officeDocument/2006/customXml
    • http://schemas.microsoft.com/sharepoint/v3/contenttype/forms

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
fa36f775458063b93e49b7c967e0ac94df51aed1ceffd807a1145f72c63502ed		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 7524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.