Office (OLE) / .XLS malware analysis — malicious · 4c13bfc6f294db1b

MALICIOUS

Office (OLE) / .XLS

238.4 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: 41f4843236601258dd09576fdddeaf57 SHA-1: e457db61a4577aa65f71b4e5379186a9d5b10403 SHA-256: 4c13bfc6f294db1b98d613d0a41319646c4c03b07d6719d7b1426c23d7a6c137

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an Excel spreadsheet containing both VBA and XLM macros. The Workbook_Open VBA macro is present and appears to initiate a game-like interface when the workbook is opened. The XLM macro sheet is also present, though its specific functionality is truncated in the provided evidence. The presence of obfuscated VBA strings and the Workbook_Open event strongly suggest a malicious intent, likely to execute further stages or to trick the user into interacting with the document.

Heuristics 4

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `07db30b99e203ff3937bf88a8b8217abfa4d29e8672de51b308cfb3596caa5b5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.