Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d1ec88f75d1134f2…

MALICIOUS

Office (OLE)

148.5 KB Created: 2020-07-09 10:28:47 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: 0e08cfc72b49a23f004c5a944b69478f SHA-1: 8f55d06882f10d0e2d1f42b020e836ae37e4a67e SHA-256: d1ec88f75d1134f2df67601950a89d727579cadcd69c34a53ab11847aee99e0e
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical heuristic firing indicates the presence of an Excel 4.0 Auto_Open macro, which is designed to execute automatically when the workbook is opened. This macro functionality is commonly abused to download and execute malicious payloads. No specific IOCs were extracted, but the technique strongly suggests a downloader or initial access vector.

Heuristics 2

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 93010 bytes
SHA-256: 77f84cf56a1341203f8740dc9b859c247dc8c9615e8448d6c3ef71cffc47e7b0
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     17 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  fZGmhRkc
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!CW47123 
' 0018     31 LABEL : Cell Value, String Constant - fNTix hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Could contain following functions: EXEC - Remaining, unparsed expression: b'\x00\x00\xbf\xb7\x1e\xb8n\x00n\x00'
' 0018     31 LABEL : Cell Value, String Constant - ImipY hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\n\xb8\xfd\xb80\x000\x00'
' 0018     29 LABEL : Cell Value, String Constant - KpmGeRx hidden len=7 ptgRef3d  Sheet!CW47127 
' 0018     31 LABEL : Cell Value, String Constant - mhEzmlxhF hidden len=7 ptgRef3d  Sheet!CW47123 
' 0018     30 LABEL : Cell Value, String Constant - ncLuZqMX hidden len=7 ptgRef3d  Sheet!CW47125 
' 0018     30 LABEL : Cell Value, String Constant - SFVJ hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xd4\xb7f\xb8T\x00T\x00'
' 0018     31 LABEL : Cell Value, String Constant - SUOxF hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xbf\xb7C\xb8K\x00K\x00'
' 0018     32 LABEL : Cell Value, String Constant - VySBYeGqZJ hidden len=7 ptgRef3d  Sheet!CW47128 
' 0018     29 LABEL : Cell Value, String Constant - yyseWSt hidden len=7 ptgRef3d  Sheet!CW47129 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     1
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.