Office (OLE) / .XLS malware analysis — malicious · d578210ff85b2876

MALICIOUS

Office (OLE) / .XLS

32.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-08-25

MD5: 33aa4fda43ede4fd68231ee882ef5836 SHA-1: a483c419ed2d31235fdfad2c3c6d2f75d06317d8 SHA-256: d578210ff85b2876e54ee0d2a10452a67eb71434ca5a081af18c21362ead19e8

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic

The VBA macro contains a call to CreateObject and references PowerShell, indicating it's designed to execute a malicious script. The script itself reconstructs and executes a PowerShell command that downloads a VBScript file named 'notepad.vbs' from the URL 'http://dafdghf.lm/lcgs/detcetorP Client/sbv.tneilC/pmet:vne$,'sbv.dapeton\'' and then executes it. This indicates a downloader pattern.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d33c08d1464ba3c2512d3e3a3bf0d3f3bbf94fcf978027c9713a45b0a35525ac`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1377 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.