Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 c93dd3f4f5789f89…

MALICIOUS

Office (OLE) / .XLS

736.5 KB Created: 2020-07-08 20:30:14 Authoring application: Microsoft Excel
MD5: 8074ac3927dfb130c1fb20d7b248a339 SHA-1: 76983644278ba4979fca636ea89bd0076e64c146 SHA-256: c93dd3f4f5789f893339c8fb5d1ccf64f5ad56a7740c311be0fd43193e361c96
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1204.002 User Execution: Malicious File T1105 Ingress Tool Transfer

The sample is an Excel OLE file containing Excel 4.0 (XLM) macros. Heuristics indicate the presence of an Auto_Open macro that utilizes dangerous formula APIs (RUN), which is typically used to execute arbitrary commands or download payloads. The extracted scripts are truncated, but the ClamAV detection 'Xls.Dropper.Agent' and the presence of XLM auto-execution markers strongly suggest a dropper functionality.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • ClamAV: Xls.Dropper.Agent-9020746-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-9020746-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
1ee86f6aacf40de5101cbf626889c8bb1752a4bfbb117af18c1c30d300a03954		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 114601 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.