Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 47f17ca4d1e34989…

MALICIOUS

Office (OLE) / .XLS

2.69 MB Created: 2008-05-08 04:12:13 Authoring application: Microsoft Excel
MD5: 01bf10b7f02153ead8a1a5be89381732 SHA-1: 61735d5a467633703e128d81b3a8ce85c0520d43 SHA-256: 47f17ca4d1e349898703d96b9a235635493205cb9ef94a6f33a06628618862d0
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' directly identifies this file as a legacy Excel formula macro virus, specifically mentioning 'Poppy by VicodinES' and 'Narkotic Network'. The document body contains what appears to be a list of names and locations, likely a lure to disguise the malicious nature of the spreadsheet. The presence of these markers strongly indicates a malicious intent, likely to execute arbitrary code via the formula macro.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.