Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 138c765d4b7d2881…

MALICIOUS

Office (OLE)

1.65 MB Created: 2004-02-29 22:41:52 Authoring application: Microsoft Excel
MD5: d1ad14d634078be16b725d5d744b8fd4 SHA-1: d1f077bc6870bca30535a4e9a869288b8e05176e SHA-256: 138c765d4b7d2881801a4499627c4fd6ddfb8cb3fc26bae56e67de495f15a9b1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is an Excel document containing legacy Excel 4.0 macro virus markers, specifically identifying it as 'Classic.Poppy by VicodinES'. The embedded macro code explicitly states its intent to infect other workbooks and save them as 'Book1.xls', indicating a self-propagating malicious behavior. The presence of strings like 'Hydrocodone/APAP 10-650 For Your Computer' and '(C) The Narkotic Network 1998' suggests a potential connection to older malware families or specific threat actors.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.