Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 38b4f0bc8e271854…

MALICIOUS

Office (OLE)

102.5 KB Created: 2007-02-05 04:22:02 Authoring application: Microsoft Excel First seen: 2015-09-24
MD5: 68d8e87ebc015ce68b523e3dcb67d990 SHA-1: 40e3fd6bc28e9edfa5a27e39a234c704cd5ab3c5 SHA-256: 38b4f0bc8e2718547d8886974cc7bae4a47db882ff0baf4a283e4bb872c736fa
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file identified as a legacy Excel formula macro virus. The heuristic firing 'OLE_XLS_FORMULA_MACRO_VIRUS' and the presence of markers like 'Poppy by VicodinES' and 'Narkotic Network' indicate the use of older macro techniques. The document body contains financial report-like text, likely intended to trick the user into enabling or interacting with the malicious macros.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.