Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 1627c525b27588ff…

MALICIOUS

Office (OLE) / .XLS

259.5 KB Created: 2020-09-14 21:28:14 Authoring application: Microsoft Excel
MD5: 4712ddf9b1c84a30dbaba9d7e1983b8a SHA-1: ff11e465d9e71fb362ca61bb45a7e9a767c7a93e SHA-256: 1627c525b27588ffc1431720d4a47822fd13fa7b605cde6cff315d0994a88b89
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel 4.0 macro sheet that is encrypted, preventing further static analysis of its contents. The presence of XLM macros and encryption strongly suggests malicious intent, likely to download and execute a secondary payload. The specific macro sheet BOF marker indicates the presence of XLM macros.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.