EarthKasha — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 fd669c40ad347a17…

MALICIOUS

Office (OLE) / .XLS

3.21 MB Created: 2025-03-06 03:21:37 Authoring application: Microsoft Excel First seen: 2025-03-11
MD5: c0cff8451fb639d2fd1946df7969395e SHA-1: 634d52e10e168a61c8201130f44925cc497c1251 SHA-256: fd669c40ad347a178ceead1f771af78fed66c4313013641d32ca28981acb97d5
210 Risk Score

Malware Insights

EarthKasha · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.003 Windows Command Shell T1071.001 Web Protocols

The file is detected as Xls.Phishing.EarthKasha-10045488-0 by ClamAV, indicating a phishing lure. High-severity heuristics for CreateObject and GetObject, along with VBA macro detection, confirm the presence of malicious code. The VBA script attempts to download and execute a second-stage payload, likely by creating a file in a temporary directory and then executing it, as suggested by the script's logic involving file creation and object manipulation.

Heuristics 7

  • ClamAV: Xls.Phishing.EarthKasha-10045488-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Phishing.EarthKasha-10045488-0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://support.microsoft.com/en-us/office/how-to-get-support-for-outlook-com-f5482a98-616c-4d44-b7c5-8aaaadf5c11a

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
73b2afb77688fff76566b0383fb816b7c10fb44200c411115105d589721e06b3		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 7806 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.