Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 2e34a509d382f8c9…

MALICIOUS

Office (OLE) / .XLS

3.61 MB Created: 2009-11-16 10:22:13 Authoring application: Microsoft Excel
MD5: f357b5ff6805726c4aa96d6a05922f07 SHA-1: 9a03ede11975a92995f2d59d55a99503456ab96f SHA-256: 2e34a509d382f8c9206548f5cee3bbdc210215669413bf56cfa84ad541439234
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.001 PowerShell

The file is an Excel spreadsheet containing legacy XLM macros, indicated by the 'OLE_XLM_AUTOOPEN' and 'OLE_XLS_FORMULA_MACRO_VIRUS' heuristic firings. The document body lists IT equipment and project costs, suggesting a social engineering lure to trick the user into enabling macros. The presence of markers like 'Poppy by VicodinES' and 'Narkotic Network' suggests a known, albeit older, macro-based threat. No specific second-stage payload indicators were found.

Heuristics 2

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.