Office (OLE) / .XLS malware analysis — malicious · bdd6e6b2d78759c8

MALICIOUS

Office (OLE) / .XLS

67.5 KB Created: 2017-10-19 07:59:05 Authoring application: Microsoft Excel First seen: 2022-03-04

MD5: eb235f3af6622c46e107769cfc74bd8a SHA-1: 8201c2cd664c1fc007687cbd25b8c43f19250f23 SHA-256: bdd6e6b2d78759c8c83b2c8bb48df7820548706725c844477975d48cbb2f4f0e

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The Excel file contains a Workbook_Open macro that executes a shell command. This command is constructed by concatenating multiple strings and ultimately downloads a file from 'http://fardunkan.co/mrx' to the user's temporary directory as '%temp%\downloaded_file.xls'. The macro's obfuscated nature and the use of Shell() indicate a downloader functionality, aiming to retrieve and execute further malicious content.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `977c9269a2fbf4f7637c51f30cc5d431765b6f53de48a871f4e72f701d7a8db3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2863 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.