Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 ff0c6360d7066513…

MALICIOUS

Office (OLE) / .XLSX

117.0 KB Created: 2005-07-03 17:33:14 Authoring application: Microsoft Excel First seen: 2024-05-23
MD5: 49eaa835cc167cf3c4b542ced889dc3c SHA-1: 9770fc12a9d57b39e6e07683595bdb1f4df0d800 SHA-256: ff0c6360d706651366f925109ef1fe9694c5ec19a31a3239cd8ae2dfa76ec987
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.004 Visual Basic for Applications T1059.001 PowerShell T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

The file contains Excel 4.0 macros and VBA code, with critical heuristics indicating AutoOpen functionality and the use of dangerous formula APIs like RUN. The VBA code includes an AutoOpen macro that calls ShellExecute, suggesting an attempt to execute arbitrary commands or launch other malicious components. The document body presents a deceptive interface related to text manipulation and file saving, which could be a lure to mask the malicious activity.

Heuristics 8

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
d138be72f4eee8a417d88911ae76719b9bf562ae0b65c439f58add81d2c671e4		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 3604 bytes
macros.bas
dd4681e8e3c2d7a46c4ca28e3fe6cf782f071d6471179d436730ffd7b0986fc3		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 39005 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.