Office (OLE) / .XLS malware analysis — malicious · d7d264e937a60b73

MALICIOUS

Office (OLE) / .XLS

293.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2023-05-16

MD5: 74428f91a5ce455721f2c07d64becaa4 SHA-1: 4833557bd10805ce2a8e26fc16c9cf2e861e0737 SHA-256: d7d264e937a60b73741ab7001a362b2e58b90540d3eab5121a6cfac66bf67ad9

70 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic

The critical heuristic firing indicates the sample exploits CVE-2017-0199 via an OLE2Link object to download a remote resource. The embedded URL, http://198.46.178.160/a/AAA%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23rrrr.doc, is likely the initial stage of a multi-stage attack. Although no executable VBA code was found, the presence of the OLE vulnerability and the embedded URL strongly suggests a malicious downloader.

Heuristics 3

OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199

Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://198.46.178.160/a/AAA%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23rrrr.doc

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1206 bytes
`font_00_sfnt_off00002f55.bin` `c770f9918a4512e864d5cb442b6b813020a99b29f560e058e4362ddfc8412387`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F55	11884 bytes
`font_01_sfnt_off00004cc4.bin` `dd457e884a659b63f960fd1c1b3ba45b073ca5832921ee06c6cae7a7d12bd11f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4CC4	15280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.