Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 b0668a6f59d7f6a3…

MALICIOUS

Office (OLE) / .XLS

153.0 KB Created: 2020-06-28 13:16:02 Authoring application: Microsoft Excel
MD5: ab4f936b67cf4843677d1267ccc6a59d SHA-1: 041477604825294c21530bb48a8065b72e1767ef SHA-256: b0668a6f59d7f6a32b40a61eb8981dd3fbe995406715f2ca6bd9aa41bec80549
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is an Excel 4.0 macro-enabled workbook. Heuristics indicate the presence of an Auto_Open defined name, which is a common technique for executing malicious macros upon opening the document. The macro sheet itself is large and contains obfuscated data, suggesting it is designed to download and execute a secondary payload. No specific IOCs were extracted beyond the macro sheet itself.

Heuristics 2

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
3b5380ab16e7f16a76cb224655bfa12325f74c6132a92e628bdfe3aaa9db24bf		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 107480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.