Office (OLE) / .XLS malware analysis — malicious · eb2c4f53803eb505

MALICIOUS

Office (OLE) / .XLS

398.5 KB Created: 2005-04-12 07:47:49 Authoring application: Microsoft Excel

MD5: bf2a0bf05ccdbe0a7ceda2bd7bbf4210 SHA-1: eb8a2c2486c2d77a3e7c3fa8c228a35fabc28d39 SHA-256: eb2c4f53803eb5059b3c7d5e890fc4819ccbf911b6bd440b220edb906118e54e

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File

The sample contains a Workbook_Open VBA macro, indicating it is designed to execute code automatically upon opening. The document body presents a long list of software products, likely a lure to trick the user into enabling macros. The macro's purpose is presumed to be downloading and executing a second-stage payload from one of the embedded URLs. Due to the lack of script content, the exact payload and its behavior cannot be determined.

Heuristics 3

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-26%20-%20CD-Runde%20Bereich%20Menzel/MitEAIzuSOA-20040426.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-06-04%20-%20GB%20Workshop%20Hahn%202004/GB_WKS_Hahn_EAI_Einfuehrung.ppt8
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-06-04%20-%20GB%20Workshop%20Hahn%202004/GB_WKS_Hahn_EAI_bei_SPS.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-01-16%20-%20FH%20Fulda/EAI-Ueberblick_20040116.ppt+
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2003-10-27%20-%20EAI%20Forum%20Schweiz/Vortrag%20EAIv10.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2003-09-19%20-%20Computerworld/sdm_kreutzberg_Was-macht-EAI-Projekte-erfolgreich_frei.doc�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-22%20-%20SOP%20Partner%20Conference%20Bonn/DPAG%20SOA.ppt
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/Andere/McLaughlin.pdf
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-07-02%20-%20Bereichsworkshop%20Hasse/SOACGEYSAP20040629.ppt9
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-22%20-%20SOP%20Partner%20Conference%20Bonn/SOAforDPNW20040416.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-06-28%20-%20DPAG-Workshop%20in%20Utrecht/Strategieworkshop.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-15%20-%20ComputerWorld/2004-04%20Erfahrungsbericht%20EAI.doc�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2002-11-07%20-%20GI-Fachtagung%20Software%20Management/EAI%20Beitrag%20SWManagement%202002_2002_0826_2150.docD
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/Andere/Business_Integration_aus_Kostensicht.pdf�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2002-01-30%20-%20Online%202002/Enterprise%20Application%20Integration%20-%20Online%202002%20Congress%20VI-3%20TH%20%28Endversion%29.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-20%20-%20Ruhr%20Uni%20Bochum/SWT2004-04-20_SOA.ppt2
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-11-04-DW%202004/dw2004_sdm-vortrag.pdf(
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-07-02%20-%20Bereichsworkshop%20Hasse/EAI_als_technische_Basis_einer_SOA_v1.0.ppt�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-05-01%20-%20isreport/24-25_EAI_SOAundBPM.pdf+
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/iProjekte.EAI.Ver�ffentlichungen.xls
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/�ffentlichkeitsarbeit/2004-04-22%20-%20SQM%202004/SQM2004_SOA.ppt
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Einstieg/sdm_iprojekte_EAI.pdf�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Tibco/BerichtTIBCOSeminar20050303.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Einstieg/Buch-und_Artikelbesprechung_EAI_v0.1.xls
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Tibco/Die%20EAI-Welt%20von%20Tibco_v1.1.ppt
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/IBM/Dossier-IBM-WebsphereBusinessIntegration_v03.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Mercator/Dossier-Mercator-MercatorEnterpriseBroker_v03.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Dossier-Microsoft-BizTalk_v03.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/SeeBeyond/Dossier-SeeBeyond_v03.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Tibco/Dossier-TIBCO-ActiveEnterprise_v05.doc�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Vitria/Dossier-Vitira_v02.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/SAP/Dossier_mySAP_Exchange_Infrastructure.htm
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Einstieg/EAI-AKQ-Standardpraesentation20040326.ppt@
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Architektur/EAI-Referenzarchitektur_v1.0_20030912.ppt
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Einstieg/EAI-Technologiepraktikum.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/EAILandkarte_v16.pptU
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Produkte/Mercator/Entwicklung_Mercator_Adapter_2004_06_05.doc
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Management/Global%20EAI%20Contacts.xls
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/ARCUS/Homepage%20ARCUS.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/EAI-PoC/Homepage%20AXPO%20EAI-PoC.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/COAST/Homepage%20COAST.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/EAI-Architekturberatung/Homepage%20EAI-Architekturberatung.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/EAI-Betriebskonzept/Homepage%20EAI-BK.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/EAI-Workshop/Homepage%20EAI-Workshop.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/NVS/Homepage%20NVS.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/TCAM/Homepage%20TCAM.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Projekte/carAT/Homepage%20carAT.html
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Vorgehen/Dokumentenmuster/IT_EAI_BHB_Projekt_Musterprojekt_v1.0.doc�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Vorgehen/Dokumentenmuster/IT_EAI_Betriebs-Konzept_und_Handbuch_v1.0.doc�
- http://sww.sdm.de/org/srnet/networks/communities/eai/download/Vorgehen/Dokumentenmuster/IT_EAI_SysInfo_Musteranwendung_Projekt_Musterprojekt_v1.0.doc
+31 more URL(s)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6d7ecd972c89cf88ede9221e83777793b96713c8b3cd3ea37c0be46742166b5d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	57885 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.