Malicious Office (OLE) / .XLS — malware analysis report

Heuristics 10

• Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
  OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is related Office object-delivery evidence when paired with exploit payload anomalies, but the malformed graphics record required for exact CVE attribution is not proven by this rule alone.
• ClamAV: Xls.Malware.Valyria-9756472-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Malware.Valyria-9756472-0
• URL reconstructed from XLM cell array (3 URLs) critical OLE_XLM_CELL_ARRAY_URL
  Excel 4.0 macro sheet stages its payload URL across the BIFF8 Shared String Table (one quoted-char SST entry concatenated with & at runtime), across individual numeric cells (one ASCII charcode per cell), or split across multi-char fragment cells a download formula concatenates by reference (=A1&A2&… / CONCATENATE(...)). The reconstructed URL is invisible to literal-bytes URL extraction because it is never contiguous in the workbook stream. URLs were recovered by walking the BIFF8 record stream and decoding SST entries, LABELSST/RK/NUMBER cells, and FORMULA cell-reference concatenation in token order.
• VBA macros detected medium 4 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
  Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  Matched line in script

  Set ÍèñóÅãؽ¸¼É³Õ¾Ùµ®áÍÆ´£õÒȨ́×Ùĺó²ŠìíÍë¢ = GetObject(×ÛÃê½µ¹û«Ø¿îÊØßå´¾Û«ö®çòåᣬªä̦£ÅÔsû²)

• GetObject call high OLE_VBA_GETOBJ
  GetObject call
  Matched line in script

  Set ÍèñóÅãؽ¸¼É³Õ¾Ùµ®áÍÆ´£õÒȨ́×Ùĺó²ŠìíÍë¢ = GetObject(×ÛÃê½µ¹û«Ø¿îÊØßå´¾Û«ö®çòåᣬªä̦£ÅÔsû²)

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Sub Workbook_Open()

• Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
  Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.cmu.edu/blackboard Referenced by macro

  • http://www.cmu.edu/blackboard/files/evaluate/tests-example.xlsReferenced by macro
  • http://www.cmu.edu/blackboard/evaluate#manage_tests/import_questionsReferenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.