MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file contains Excel 4.0 macros, specifically an Auto_Open defined name, which is a critical finding. The macros utilize dangerous functions such as RUN, indicating an intent to execute arbitrary code. This is a common technique for downloading and executing secondary payloads, hence the classification as an unknown family downloader.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 130036 bytes |
SHA-256: 8ec4b399fc0c2204d6446e034ceb98405c61cf4672b0923a9535dda2fe849c3f |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Sheet ' 0018 28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d Sheet!FC15725 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' Sheet,JK15,"",574.50000000000000000000 ' Sheet,Q60,"",-0.24398625429553263966 ' Sheet,Z81,"",-304.00000000000000000000 ' Sheet,EU111,"",124.50000000000000000000 ' Sheet,FU112,"",-216.00000000000000000000 ' Sheet,IS137,"",-310.00000000000000000000 ' Sheet,HQ160,"",-90.00000000000000000000 ' Sheet,BE220,"",-275.00000000000000000000 ' Sheet,ID234,"",-4.06034382758620715492 ' Sheet,IB242,"",-1581.00000000000000000000 ' Sheet,JF266,"",-94.00000000000000000000 ' Sheet,HD273,"",50.00000000000000000000 ' Sheet,BK283,"",-0.80745341614906829264 ' Sheet,JM331,"",-0.07232913072329130721 ' Sheet,GY521,"",352.00000000000000000000 ' Sheet,GE549,"",175.00000000000000000000 ' Sheet,CJ557,"",-5.64444444444444481945 ' Sheet,DY566,"",191.50000000000000000000 ' Sheet,GW568,"",311.00000000000000000000 ' Sheet,HQ581,"",-1.00000000000000000000 ' Sheet,JR593,"",-185.00000000000000000000 ' Sheet,FX609,"",-5.11842105263157876038 ' Sheet,DS677,"",-130.50000000000000000000 ' Sheet,FK683,"",2.22727272727272707087 ' Sheet,CS703,"",-1.71428571428571419055 ' Sheet,IP708,"",111.50000000000000000000 ' Sheet,EX726,"",6.58823529411764674535 ' Sheet,GR772,"",2392.00000000000000000000 ' Sheet,FP833,"",153.00000000000000000000 ' Sheet,EA834,"",-0.27506426735218508783 ' Sheet,BN838,"",-101.00000000000000000000 ' Sheet,DX866,"",-4.66336633663366306735 ' Sheet,FE1027,"",133.00000000000000000000 ' Sheet,BP1037,"",-5.54166666666666696273 ' Sheet,CA1079,"",4.84905660377358493918 ' Sheet,GH1128,"",-212.00000000000000000000 ' Sheet,BE1138,"",-1.25465838509316762739 ' Sheet,JD1173,"",-1.75000000000000000000 ' Sheet,DY1202,"",-2.39639639639639634439 ' Sheet,FZ1388,"",7.66071428571428558740 ' Sheet,FS1448,"",339.00000000000000000000 ' Sheet,FI1450,"",-5.93877551020408134264 ' Sheet,BJ1453,"",-0.65217391304347827052 ' Sheet,HY1462,"",-136.00000000000000000000 ' Sheet,BG1480,"",2403.00000000000000000000 ' Sheet,JF1567,"",108.00000000000000000000 ' Sheet,FW1585,"",-340.00000000000000000000 ' Sheet,EH1624,"",3.03125000000000000000 ' Sheet,GE1641,"",-5.32000488281250039080 ' Sheet,JT1689,"",154.00000000000000000000 ' Sheet,DX1710,"",0.23809523809523808202 ' Sheet,DR1745,"",-0.07697412076974120831 ' Sheet,JA1748,"",-2.20588235294117662733 ' Sheet,JC1769,"",16.00000000000000000000 ' Sheet,EC1785,"",2362.00000000000000000000 ' Sheet,K1826,"",-4.18279569892473102044 ' Sheet,IU1840,"",40.49180327868852202755 ' Sheet,D1842,"",-0.54658385093167705104 ' Sheet,BF1883,"",359.00000000000000000000 ' Sheet,GA1988,"",-0.10615711252653928232 ' Sheet,HP1998,"",345.00000000000000000000 ' Sheet,FY2001,"",-84.00000000000000000000 ' Sheet,HO2032,"",0.04615384615384615641 ' Sheet,DX2074,"",-574.50000000000000000000 ' Sheet,DI2110,"",-0.13058419243986255087 ' Sheet,GE2123,"",0.13053613053613052908 ' Sheet,EZ2149,"",0.19940476190476191798 ' Sheet,DT2157,"",-3.36708860759493688874 ' Sheet,CN2162,"",-1.20000061035156257994 ' Sheet,HE2300,"",187.00000000000000000000 ' Sheet,C2302,"",316.00000000000000000000 ' Sheet,BH2409,"",2379.00000000000000000000 ' Sheet,II2421,"",318.00000000000000000000 ' Sheet,FP2449,"",-0.16141732283464566011 ' Sheet,P2517,"",0.98000061035156249556 ' Sheet,IT2519,"",-0.94705882352941173075 ' Sheet,JO2615,"",-1.82954545454545458583 ' Sheet,GF2637,"",-2358.00000000000000000000 ' Sheet,CI2742,"",-341.00000000000000000000 ' Sheet,S2782,"",-92.00000000000000000000 ' Sheet,N2789,"",0.06666666666666666574 ' Sheet,JT2814,"",-0.11311053984575834830 ' Sheet,GG2853,"",8.81506849315068485851 ' Sheet,DM2871,"",-7.47058823529 ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.