Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2172c63d929d6627…

MALICIOUS

Office (OLE)

3.67 MB Created: 2000-05-26 16:45:09 Authoring application: Microsoft Excel
MD5: 588f94be4d7d3381d91cd53c5c8393b4 SHA-1: c57861e74b68112be074d4f6b17680d2b1970208 SHA-256: 2172c63d929d6627a6107e842d4014fcdc95cd974295ff29731768e83f465c10
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file is identified as malicious due to critical heuristic firings indicating the presence of legacy Excel 4.0 (XLM) macros, specifically the Auto_Open function and legacy macro-virus markers. The document body contains Vietnamese text related to construction cost estimation, which may serve as a lure. No specific script content was fully extracted or analyzed, but the presence of XLM macros strongly suggests an initial execution vector for malware delivery. The ClamAV detection further corroborates the malicious nature of the file.

Heuristics 4

  • Excel 4.0 (XLM) Auto_Open + macro sheet critical OLE_XLM_AUTOOPEN
    Workbook contains an Auto_Open / Auto_Close defined name together with an Excel 4.0 macro sheet — the canonical XLM auto-execution shape used by malware families such as Emotet and QakBot.
  • Legacy XLM macro-virus family marker critical OLE_XLM_LEGACY_MACRO_VIRUS
    Workbook contains an Excel 4.0 macro Auto_Open chain and legacy macro-virus family strings. This is a narrow indicator for infected XLM workbooks rather than ordinary formula use.
  • ClamAV: Xls.Malware.Generic-6680536-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Generic-6680536-0
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f1a0a1924498708ffcd80c76cbe0099a7455fcbadc042a137c46e5b69a1d37b8		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 9033 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.