Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e7529044d473f6b8…

MALICIOUS

Office (OLE)

152.5 KB Created: 2020-07-08 13:42:32 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: bf51c240a19ef4c70131ec91208e1efe SHA-1: 1a6ff68d5b8c9af2f68723046723087f060bafa2 SHA-256: e7529044d473f6b84e93c1840732c593385b0375552263945dca0e234ecd3803
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains Excel 4.0 macros, specifically an Auto_Open defined name, which is a strong indicator of malicious intent. This technique is commonly used to execute arbitrary code upon opening the document. While no specific URLs or payloads were extracted, the presence of the macro strongly suggests the file is designed to download and execute a secondary malicious payload.

Heuristics 2

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 94460 bytes
SHA-256: 3a58532f242237d18f8a906a366fbf2e7cb74b9619a1163155ebad6af527ed3d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  NRmk9K
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  IHueJ
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!HD47387 
' 0018     30 LABEL : Cell Value, String Constant - cwpd hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xd6\xb87\xb9\x82\x00\x82\x00'
' 0018     29 LABEL : Cell Value, String Constant - fWgYZmR hidden len=7 ptgRef3d  Sheet!HD47392 
' 0018     31 LABEL : Cell Value, String Constant - IIaRw hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00+\xb9\xc0\xb9\x81\x00\x81\x00'
' 0018     31 LABEL : Cell Value, String Constant - IULRwbbBf hidden len=7 ptgRef3d  Sheet!HD47389 
' 0018     31 LABEL : Cell Value, String Constant - lKLurmrkn hidden len=7 ptgRef3d  Sheet!HD47387 
' 0018     29 LABEL : Cell Value, String Constant - mwm hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x02\xb9\xef\xb9\xc1\x00\xc1\x00'
' 0018     31 LABEL : Cell Value, String Constant - PNCRNazYP hidden len=7 ptgRef3d  Sheet!HD47391 
' 0018     31 LABEL : Cell Value, String Constant - VHBln hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\xd4\xb8V\xb9\xc3\x00\xc3\x00'
' 0018     30 LABEL : Cell Value, String Constant - wCYJlRBF hidden len=7 ptgRef3d  Sheet!HD47393 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, S
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.