Office (OLE) / .XL malware analysis — malicious · 4ee1e6a9f7c9ff47

MALICIOUS

Office (OLE) / .XL

139.5 KB Created: 2005-11-10 08:10:47

MD5: 60b8efcbb789cc7a6f38214d00da6041 SHA-1: 84c79be21d286134543d3091304d20d4e6377e8e SHA-256: 4ee1e6a9f7c9ff4745aec0622dc39f4450096a212bc8ddd1bb9190528053c3aa

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.001 PowerShell

The file was detected as malicious by ClamAV with multiple signatures indicating it is a macro-based threat. The presence of an Auto_Open macro strongly suggests that the VBA code within the document is intended to execute automatically upon opening, likely to download and execute a second-stage payload. The extracted document body content appears to be related to tax or financial reporting, which could be used as a lure.

Heuristics 4

ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `640e2588e85da3b80d6d6bc56fcd303d176e7ebbca6629535ac3f822baeb8a4f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	30396 bytes
Detection ClamAV: Xls.Trojan.Escape-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.