Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b38787b271fd959a…

MALICIOUS

Office (OLE)

341.5 KB Created: 2004-01-22 01:30:40 Authoring application: Microsoft Excel
MD5: 0309e139d5b4591158bd6732bcdcaaee SHA-1: 2c119b69a71721f5a1be98a19da2a044afc1bf38 SHA-256: b38787b271fd959af047b20080a67fcc87af5317d09eaca661bc2c5fd851ffcb
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Service Execution: Service Execution T1059.001 PowerShell: PowerShell

The file is an Excel 4.0 macro-enabled workbook. Heuristics indicate the presence of an Auto_Open macro, which is a common technique for executing malicious code when the workbook is opened. The reference to Windows Script Host further suggests the execution of scripts. While the specific payload is not detailed, the presence of an Auto_Open macro strongly implies an intent to run arbitrary code, likely for downloading and executing a secondary stage.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
2f8153fa2af8d39e5bf6414afa9affbd60d9c4dfbb448c334ea9ff774ff8b783		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 13096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.