Office (OLE) / .XLS malware analysis — malicious · d55b6d283b51aad1

MALICIOUS

Office (OLE) / .XLS

36.0 KB Created: 2021-02-16 16:40:52 Authoring application: Microsoft Excel

MD5: f99f956ba1e1fb8785d1499443e6f1e5 SHA-1: 2767632e925e9d9f20ef372a869a84c054d2e9c8 SHA-256: d55b6d283b51aad17fc4e329bcc4628991dc06f7e7b064c0c35388276c168628

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The sample is an Excel 4.0 spreadsheet containing an Auto_Open macro, indicated by the OLE_XLM_AUTOOPEN and OLE_XLM_AUTOOPEN_DEFINEDNAME heuristics. The macro sheet contains complex formulas and string concatenations that are obfuscated, but the presence of an Auto_Open entry strongly suggests it is designed to execute malicious code upon opening. The specific formulas and references within the macro sheet, such as Sheet1!R84C7:R99C7 and R92C14:R101C14, are likely part of the payload execution or obfuscation mechanism.

Heuristics 2

Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME

oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `24322a1148dc18f96a2ca584788a7b7430401ec83e1aaeddc957846c5cc1be91`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	16629 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.