Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 0247b15c88e81e61…

MALICIOUS

Office (OLE) / .XLS

249.5 KB Created: 2020-09-20 23:06:53 Authoring application: Microsoft Excel
MD5: a539a465e38372fd68fc10c96a1e5d00 SHA-1: a21688d0a31590f7be51c4637406640389baa344 SHA-256: 0247b15c88e81e6106f0bd3b257d424b96dd8c27f7035c8d2b4db33d608f4af2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel 4.0 macro sheet that is encrypted, indicating obfuscation of its contents. The presence of an 'AUTOOPEN' macro suggests it is designed to execute automatically upon opening. The encrypted nature and automatic execution point towards a downloader or dropper functionality, though the specific payload and destination cannot be determined from the provided evidence.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.