Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 bfa79dc913e0b0f3…

MALICIOUS

Office (OLE) / .XLS

67.0 KB Created: 2007-08-27 02:31:36 Authoring application: Microsoft Excel First seen: 2023-07-18
MD5: 3e61aca9af54b1264637b745135ed107 SHA-1: 9255c38bf09a94ca426178522a8c508b7452649b SHA-256: bfa79dc913e0b0f3badbff43743f7e694541160a3f2638406e346fddf12a8cd6
162 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1059.005 Visual Basic

The file is detected as a malicious Excel document (Xls.Exploit.Generic-6705249-0) and contains VBA macros. The macros, specifically the 'InsertPicFromFile' subroutine, are designed to download and display an image from a specified file location, which can be a local path or a URL. While the provided URLs are benign, the presence of exploit heuristics like NOP sled and heap spray, combined with the macro's functionality, suggests an attempt to exploit a vulnerability or deliver a malicious payload disguised as an image display mechanism.

Heuristics 5

  • ClamAV: Xls.Exploit.Generic-6705249-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Exploit.Generic-6705249-0
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • Heap-spray pattern detected high SC_HEAP_SPRAY
    Repeated 0x41 (A) bytes found
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png
    • http://www.website.com/MyPic.jpg)F8:G10
    • http://www.website.com/MyPic.jpg
    • http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png�

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f52259942723f63e5c776c4ed3b05fb80d544cfee2542ba66e3c48b7beeb9fbf		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2587 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.