Office (OLE) / .XLS malware analysis — malicious · 4bd7b3fa7e974323

MALICIOUS

Office (OLE) / .XLS

166.5 KB Created: 2021-08-09 13:30:37 Authoring application: Microsoft Excel First seen: 2023-09-07

MD5: 03311f48686395e1e9da241413616fd2 SHA-1: bbba03c86107c5b191d00e8a5b884f3cd3dd7728 SHA-256: 4bd7b3fa7e974323e1ccc8da9196bf7b7dc1cf62590f19decbbe246c931d7634

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an Excel spreadsheet containing VBA macros, specifically a Workbook_Open macro, which is a common technique for executing malicious code upon opening. The ClamAV detection 'Doc.Downloader.Donot-10026071-0' strongly suggests its role as a downloader. The VBA code itself appears heavily obfuscated with API calls, indicating an attempt to hide its true functionality, likely to download and execute a secondary payload.

Heuristics 3

ClamAV: Doc.Downloader.Donot-10026071-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Donot-10026071-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ebeade07e5820500d32b9c9cef613abadb60bedd34384f094fc21e362975c78e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	118419 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.