Office (OLE) / .XLS malware analysis — malicious · d03416fa25a5f6f7

MALICIOUS

Office (OLE) / .XLS

525.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2021-05-26

MD5: 33880147c298acaac3a37949baf5c5a2 SHA-1: 67945b2d8ff71b172ec417d61b036f46ea096d34 SHA-256: d03416fa25a5f6f79f311ec4ccbd7e2132abdef70b8549a2f17c0f21eb3e08b2

142 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1059.005 Command and Scripting Interpreter: Visual Basic

The presence of an Excel 4.0 macro sheet (XLM) and a heuristic indicating a content-enable lure strongly suggests a malicious intent. The document likely uses social engineering to trick the user into enabling macros, which would then execute the embedded XLM macro. This macro is expected to download and execute a second-stage payload from one of the provided URLs.

Heuristics 5

XLM Auto_Open workbook with payload URL or enable-content lure critical OLE_XLM_AUTOOPEN_PAYLOAD_LURE

Workbook contains an Excel 4.0 macro sheet with Auto_Open / Auto_Close and also exposes a payload URL or enable-content lure in the OLE bytes. This combination is a high-confidence XLM downloader/social-engineering pattern even when formula recovery cannot decode the full macro chain.
Excel 4.0 (XLM) macro sheet uses dangerous capability functions high OLE_XLM_DANGEROUS_FN_STATIC

Workbook contains an Excel 4.0 macro sheet whose formulas reference two or more dangerous capability functions (e.g. CALL into a Win32 API such as URLDownloadToFile, EXEC to launch a process, REGISTER an external DLL procedure, or FWRITE/FOPEN to drop a file) with an Auto_Open / Auto_Close auto-execution name. This is the canonical XLM downloader/dropper shape and is recovered directly from the BIFF records, so it fires even when the full macro chain cannot be deobfuscated.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://aravindanavada.com/AHt5r3T0VSlq/solo.html In document text (OLE body)
- https://mrcrgroup.com/sOyQynNJYBY/solo.htmlIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.