Office (OLE) / .XLS malware analysis — malicious · 3185a2c452fc0390

MALICIOUS

Office (OLE) / .XLS

648.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: c28b6f317a3806e4e93dca2336597a4c SHA-1: ce48b0056a973f8c2d830cdbfa3c779df8dfa7ca SHA-256: 3185a2c452fc0390c21ea847a987de80ec54b8d472fdf01fdfd7725e16697109

240 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.005 Visual Basic

The critical heuristic firing for CVE-2014-4114 indicates the exploitation of a known vulnerability in OLE packages to deliver an executable payload. The presence of VBA macros, specifically an Auto_Open macro, further supports the malicious intent. ClamAV detections confirm the file is recognized as malware. The document body contains seemingly innocuous text related to quality control, likely serving as a lure.

Heuristics 5

CVE-2014-4114 — OLE Package with executable payload critical CVE likely CVE_2014_4114

OLE Package CLSID found alongside executable file references — a strong CVE-2014-4114/Sandworm-style package-dropper indicator.
ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `fb2929454da53a7c274256eb0b38ca9476f9f1c61d52f3b7e15bf6ac20b85c3e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2073 bytes
Detection ClamAV: Xls.Trojan.Escape-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.