Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 3984d2dee65511f8…

MALICIOUS

Office (OLE) / .XLS

49.5 KB Created: 2020-11-02 13:04:55 Authoring application: Microsoft Excel
MD5: cb896047095b16806720ab616fdc5fe3 SHA-1: 688a7488d7b18daf0cc62b2f96f61425d2787c19 SHA-256: 3984d2dee65511f8dc9b9e824fc2201c48a4c1c4158982c7b1531cbc6547cf27
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical ClamAV heuristic firing indicates this file is recognized as malware. The presence of VBA macros, as flagged by the medium heuristic, suggests a malicious script is embedded within the document. The document body contains heavily obfuscated strings, further supporting the likelihood of malicious code execution. The primary intent appears to be downloading and executing a secondary payload, typical of many malware droppers.

Heuristics 2

  • ClamAV: Win.Malware.Agent-9786449-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Malware.Agent-9786449-0
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
dbefb76d6dc68dcae6dda31b8decb8f5fac099e2fd42385c924b2efebfa5ffa4		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2018 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.