Malicious Office (OLE) / .EXE — malware analysis report

Static analysis result for SHA-256 175ff68102d44dc1…

MALICIOUS

Office (OLE) / .EXE

34.0 KB Created: 1998-05-15 14:24:50 Authoring application: Microsoft Excel
MD5: 8936932bb0a90f2d2addffb9dc1f9431 SHA-1: fc5d0c4cd83f96006122cb425723bd2054b05c20 SHA-256: 175ff68102d44dc169e0b07d788d5d344afb961acc60d38573921f2438161766
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file contains a critical heuristic indicating it is an Excel 5 Laroux macro virus, specifically triggering on 'auto_open' and 'check_files' functions. The VBA script attempts to create a directory 'C:\WINDOS' and save a file named 'WINDOS.XLS' within it, likely to establish persistence. The script also manipulates `Application.OnSheetActivate` and `Application.AltStartupPath`, suggesting an attempt to control execution flow and potentially hide its presence.

Heuristics 3

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
661f7064fff90093da952368aef5aa5a0ffc4bcd768a5c8b44f469cc432931d4		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2217 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.