Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 bc45407e7b8938df…

MALICIOUS

Office (OLE) / .XLS

1.18 MB Created: 2011-08-18 15:48:04
MD5: fbf90997ee920640632d8b493659658f SHA-1: 37e4512adc53ec68787433f1ace5ecf0072890a7 SHA-256: bc45407e7b8938df38ebaf900358427dd209a6039cf05148aa989f51d5e89a3c
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains VBA macros that utilize the URLDownloadToFile API, indicating an intent to download and execute a second-stage payload. The embedded URLs, while appearing to be benign image links, are associated with the malicious verdict. The document body content is a product listing, likely a lure to disguise the malicious macro's true purpose. No specific family could be identified, but the technique of using macro-based downloaders is common.

Heuristics 4

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://detsad-shop.ru/images/detailed/113/1__2_.jpg
    • https://detsad-shop.ru/images/detailed/87/1569938369176.png
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://purl.org/dc/elements/1.1/
    • http://www.iec.ch

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a28517c241bfa187e62809e2361215c610609379e8eccb7e797bd0ba82f666db		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 7212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.