Office (OLE) / .XLS malware analysis — malicious · 2c1f753631313513

MALICIOUS

Office (OLE) / .XLS

1.54 MB Created: 2009-05-07 07:21:11 Authoring application: Microsoft Excel

MD5: 4feab91159bf8f0c1b1d9ace3fc2b3b5 SHA-1: 2817099a6567657f90db36da96df08daaee1a848 SHA-256: 2c1f753631313513a985d35329ac54312785b3a214e053ecf003c129161b3168

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The sample is an Excel file containing VBA macros, specifically triggering on Workbook_Open and Auto_Open events. These macros are likely designed to execute malicious code upon opening the document. No specific malware family could be identified, but the technique suggests a common delivery method for malware. The presence of VBA macros and the auto-execution triggers are the primary indicators of malicious intent.

Heuristics 3

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2a8a4609afb75ff3030d162aeb98b0b4b7b6050de6f2a874c6163629ccd04462`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.