Office (OLE) / .XLS malware analysis — malicious · e05fe5026485aec6

MALICIOUS

Office (OLE) / .XLS

65.5 KB Created: 2022-10-24 06:47:42 Authoring application: Microsoft Excel First seen: 2022-10-24

MD5: 849da41df2fb55e5c586d017a4e7b3f5 SHA-1: bf43bf2332fe4e363c0629a3ca0a6d09e00b591f SHA-256: e05fe5026485aec688c19ebca312e79cf06bd08c9e2182f25195cc49571ec7c4

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains VBA macros that utilize the Shell() function to execute a downloaded payload. The script attempts to download content from the hardcoded string 'Mh9tV1t549p0sE:W/24/fPor45tihE3oo20k.cD77o6mH', decodes it from Base64, and saves it to a temporary file. This indicates a downloader functionality, likely to fetch and execute further malicious stages.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Xls.Downloader.b83ac4c497e169b5-9980307-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.b83ac4c497e169b5-9980307-0
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `30b7148822c72f10d201765586b49cf59d51e49b514b2fd1feee7726b7a3de72`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3169 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.