Office (OLE) / .XLS malware analysis — malicious · bd24e172bbce361d

MALICIOUS

Office (OLE) / .XLS

43.0 KB Created: 2023-02-15 08:45:23 First seen: 2023-02-16

MD5: 97ba10361cdccb8b9381fe69966bd946 SHA-1: 628abd566404f661f9a5dbd7c2e91115ad641069 SHA-256: bd24e172bbce361de691074937bfa1a586ce6c991ee9e1f1a5011017aa5259b3

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter

The VBA macro contains calls to `URLDownloadToFileA` and `Shell()`, indicating it is designed to download and execute a secondary payload. The script constructs a temporary filename using `Environ$("USERPROFILE") & "\Documents\" & <random_name> & ".raw"` and attempts to open it for output, suggesting it will be used to save the downloaded file. The use of `URLDownloadToFileA` directly points to Ingress Tool Transfer.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1d3a063a3b0b3b63e0039d8d364b9472fcc7aa5b961e77ed3aade914a4472519`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2234 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.