Office (OLE) / .XLS malware analysis — malicious · f204f5c9c0e6edd9

MALICIOUS

Office (OLE) / .XLS

81.5 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel

MD5: 13bb355c25fdbf5f65580bd7a23cf9ee SHA-1: 1a7455ac80fb7b7fe8ed2f74ec8d0ddfb036dd41 SHA-256: f204f5c9c0e6edd9e0e6fe5a1d8727ace01393fe80c418c63e656b579c8a140a

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample is an Excel 4.0 macro-enabled spreadsheet. The Auto_Open macro triggers the execution of an XLM macro. This XLM macro reconstructs and executes a PowerShell command to download 'fv.exe' from 'https://tinyurl.com/y3zdhzor' and then moves it to the user's AppData directory. The XLM macro also contains a second PowerShell command to execute the downloaded file after a short delay.

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `995a5aeb599df386fbd63cf0b756bfd3d97e395da774ae498f44c5c4e032c9be`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1686 bytes
`macros.bas` `96e1fd81321ec96d4572821a232ac3b005971f4f8d249d2f394feee882bc8d89`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.