Office (OLE) malware analysis — malicious · 3ac537aeb3cd3c6c

MALICIOUS

Office (OLE)

352.0 KB Created: 2010-09-09 01:30:25 Authoring application: Microsoft Excel First seen: 2015-09-14

MD5: 00455e8ffc3cb992191e44194c8d71a0 SHA-1: 01bdba4b82ab0148b82e3721c61fa706dd6f9a4d SHA-256: 3ac537aeb3cd3c6c29a77ed30a3bf4cf7971a96141baa422544d846a1cb06a93

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel document containing Excel 4.0 macros, indicated by the OLE_XLM_AUTOOPEN heuristic. The SC_STR_WSCRIPT heuristic suggests that these macros are used to invoke Windows Script Host, a common method for executing downloaded payloads. No specific family could be identified, and no direct IOCs like URLs or hashes were extracted from the provided evidence.

Heuristics 2

Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.