Office (OLE) / .XLS malware analysis — malicious · e9025e83eee4a493

MALICIOUS

Office (OLE) / .XLS

988.0 KB Created: 2023-06-01 01:27:25 Authoring application: Microsoft Excel First seen: 2023-06-01

MD5: af6d1614da49a3794aa118633f0dbcb9 SHA-1: 61b5dc5e4d9db690539ac0f89f66e8f11ac5f8a7 SHA-256: e9025e83eee4a4936dbea2ce192b977756b629fe4c75320216dac882df75005c

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The Excel file contains a Workbook_Open and Auto_Open macro that calls a function to execute a file named CC.inf from the temporary directory. The macro attempts to use the LaunchINFSectionW API, suggesting it's designed to execute an INF file, which is a common technique for initial payload execution. The presence of the Environ() call indicates it's attempting to dynamically locate the temporary directory.

Heuristics 5

ClamAV: Xls.Malware.Sdrop-10003549-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sdrop-10003549-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2d5ddc34211f6a413d979569e15611423710327a27ebcf36527ff83093f41353`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	224578 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.