Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 03b6e8d23d8e8c90…

MALICIOUS

Office (OLE)

451.0 KB Created: 2007-06-20 22:57:23 Authoring application: Microsoft Excel First seen: 2015-09-30
MD5: 84b8c0b8ec7be8cc8d8cd56a29e1ee80 SHA-1: 648cfaff12db5c45deeef9df736690ff562bf688 SHA-256: 03b6e8d23d8e8c90e232e44c73f607db09ed2dc957b3e46bc9317d60000745c1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a legacy Excel formula macro virus, specifically 'Classic.Poppy' by 'VicodinES' and 'The Narkotic Network'. The embedded text indicates its intent to infect other workbooks and potentially execute arbitrary code, as suggested by the presence of formula macros and infection routines. The IOCs are derived from the heuristic findings and the document body, which explicitly names the virus and its components.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.