Office (OLE) / .XLS malware analysis — malicious · e3af0d46ee8982cd

MALICIOUS

Office (OLE) / .XLS

327.5 KB Created: 2020-11-17 01:44:48

MD5: b534235b7d0ed0f7b7c775d11262669c SHA-1: c5c94832a8fc01eaaef61b049ad65ed828b9276d SHA-256: e3af0d46ee8982cd06d707feffc174639b8ac1bc97b2e408f23c65a47fde41bd

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.001 PowerShell

The sample is an XLS file containing VBA macros, specifically a Workbook_Open macro. This macro utilizes the Shell() function and URLDownloadToFile to download and execute a second-stage payload from a remote URL. The presence of these functions strongly indicates a downloader or droppper functionality.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2f86a66054ed9d9e50e79b452e93c2ac5616bdac263e7eaf84d6a2fbc8049f73`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3402 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.