Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 bfa79dc913e0b0f3…

MALICIOUS

Office (OLE) / .XLS

67.0 KB Created: 2007-08-27 02:31:36 Authoring application: Microsoft Excel First seen: 2023-07-18
MD5: 3e61aca9af54b1264637b745135ed107 SHA-1: 9255c38bf09a94ca426178522a8c508b7452649b SHA-256: bfa79dc913e0b0f3badbff43743f7e694541160a3f2638406e346fddf12a8cd6
162 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a generic exploit signature, and static analysis reveals NOP sled and heap spray patterns indicative of an exploit. The embedded VBA macro contains code that attempts to download and display an image from a specified file location, which could be a remote URL. This suggests the file is designed to exploit a vulnerability to execute code or display malicious content, likely delivered via spearphishing.

Heuristics 5

  • ClamAV: Xls.Exploit.Generic-6705249-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Exploit.Generic-6705249-0
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'nop' is 100% of instructions — a sled or padding/filler run, not program logic).
  • Heap-spray pattern detected high SC_HEAP_SPRAY
    Repeated 0x41 (A) bytes found
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'inc' is 78% of instructions — a sled or padding/filler run, not program logic).
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png In document text (OLE body)
    • http://www.website.com/MyPic.jpg)F8:G10In document text (OLE body)
    • http://www.website.com/MyPic.jpgIn document text (OLE body)
    • http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png�In document text (OLE body)
🗂 Part of campaign: shared payload f522599427 4 samples

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2587 bytes
SHA-256: f52259942723f63e5c776c4ed3b05fb80d544cfee2542ba66e3c48b7beeb9fbf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
' Downloaded from www.contextures.com
Private Sub Worksheet_Change(ByVal Target As Range)
   If Not Intersect(Target, Range("rngDisplayName")) Is Nothing Then
         InsertPicFromFile _
            strFileLoc:=Range("rngFileLocation").Value, _
            rDestCells:=Range("rngPicDisplayCells"), _
            blnFitInDestHeight:=True, _
            strPicName:="MyDVPic"
   End If
End Sub


Attribute VB_Name = "modShowFilePics"
Option Explicit
' Downloaded from www.contextures.com
'******************************
'* InserPicFromFile           *
'* Programmer: Ron Coderre    *
'* Last Update: 20-SEP-2007   *
'******************************
Sub InsertPicFromFile( _
   strFileLoc As String, _
   rDestCells As Range, _
   blnFitInDestHeight As Boolean, _
   strPicName As String)

   Dim oNewPic As Shape
   Dim shtWS As Worksheet

   Set shtWS = rDestCells.Parent

   On Error Resume Next
   'Delete the named picture (if it already exists)
   shtWS.Shapes(strPicName).Delete
   
   On Error Resume Next
   With rDestCells
      'Create the new picture
      '(arbitrarily sized as a square that is the height of the rDestCells)
      Set oNewPic = shtWS.Shapes.AddPicture( _
         Filename:=strFileLoc, _
         LinkToFile:=msoFalse, _
         SaveWithDocument:=msoTrue, _
         Left:=.Left + 1, Top:=.Top + 1, Width:=.Height - 1, Height:=.Height - 1)
      
      'Maintain original aspect ratio and set to full size
      oNewPic.LockAspectRatio = msoTrue
      oNewPic.ScaleHeight Factor:=1, RelativeToOriginalSize:=msoTrue
      oNewPic.ScaleWidth Factor:=1, RelativeToOriginalSize:=msoTrue
      
      If blnFitInDestHeight = True Then
         'Resize the picture to fit in the destination cells
         oNewPic.Height = .Height - 1
      End If
      
      'Assign the desired name to the picture
      oNewPic.Name = strPicName
   End With 'rCellDest
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.