Office (OLE) / .XLS malware analysis — malicious · d16c5485f3f01fe0

MALICIOUS

Office (OLE) / .XLS

50.5 KB Created: 2023-02-07 14:15:02 Authoring application: Microsoft Excel First seen: 2023-02-08

MD5: 6d16ef1ab57e56370aca6d3897b42bdc SHA-1: 744f062ed1aafc7923ee129d116e8b85e2ceb203 SHA-256: d16c5485f3f01fe0d0ce9387e9c92b561ef4d42f0a22dde77f18a424079c87cd

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The VBA macros contain critical heuristic firings for downloading and executing a file via Shell() and CreateObject() calls. The script attempts to download a payload from the deobfuscated URL '2ht40t1p11s4:6/12/b5bp0li78ne3.c4o0m4', saves it to a temporary file, and then executes it. The use of MSXML2.XMLHTTP and ADODB.Stream objects is consistent with this download and execution behavior.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `62d8586f12a929bffff111fb53112605ccf30ec47b77aa9ff469415a48926dc5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.