Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 d4592471179f7d3f…

MALICIOUS

Office (OLE) / .XLS

153.0 KB Created: 2020-04-23 12:26:24 Authoring application: Microsoft Excel
MD5: 933ac69cb772d6e28636a81fc7665a26 SHA-1: 7bb7870ebb261a2e0302600330abbc819d00acd3 SHA-256: d4592471179f7d3fbd94be05591c09c74b0d8b7dcca580504694c7514c1d9ef0
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample is an Excel 4.0 macro-enabled document containing a fake decryption prompt to lure users into enabling content. The presence of ShellExecute and URLDownloadToFile API calls, along with embedded URLs pointing to DLL files, indicates that the macro is designed to download and execute a second-stage payload. The document body's instructions to 'enable content' and 'run plugin Core decryption' further support this malicious intent.

Heuristics 5

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • OLE metadata lists many Excel 4.0 macro sheets medium OLE_XLM_DOCPROPS_MACROSHEET_INVENTORY
    Workbook contains a BIFF Excel 4.0 macro-sheet marker and its clear OLE DocumentSummaryInformation stream lists many MacroN sheet titles. This is a useful static signal when FILEPASS encryption prevents formula extraction from the workbook stream.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
    • https://rnollg.com/kev/scfrd.dll$8
    • http://wmwifbajxxbcxmucxmlc.com/files/april24.dll

Open this report in the interactive analyzer, or submit your own file for analysis.