Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 b6978e11f97a8196…

MALICIOUS

Office (OLE) / .XLS

29.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-03-08
MD5: 3fef06ba2e001f3c7f9c863bec8c6fd1 SHA-1: 0d6fe17e9613c075d222c5c59ff32cd1dd660914 SHA-256: b6978e11f97a81969a4edeca3e1ace5f93aa739b15a03a8499d1c939e68ea400
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic

The VBA macro utilizes a GetObject call to execute a PowerShell command. This PowerShell command reconstructs a URL from concatenated strings and downloads a file named 'private.vbs' to the user's temporary directory. The script then executes this downloaded file. The reconstructed URL is 'http://dynamic-dns.ognompux.net/ces/oc/es/bvs.private' and the downloaded file is saved as 'private.vbs' in the temp directory.

Heuristics 2

  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
9a680e0c82e0d6a7c45666a1de3ac702bccd3ddfa58e09ee4b21a8b61a782b42		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 810 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.