XF.Classic — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 501bebbe3f5789b2…

MALICIOUS

Office (OLE) / .XLS

414.0 KB Created: 2010-04-30 23:23:17 Authoring application: Microsoft Excel
MD5: 3181c209681531e475df7d1971a7e91a SHA-1: bd429060a2765c9fa4efe89e62eb4a831427a761 SHA-256: 501bebbe3f5789b2757b809f2462af240ad5f314cd97e7b9d4e5e46a9c0b4745
60 Risk Score

Malware Insights

XF.Classic · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic firing indicates this is a legacy Excel formula macro virus known as XF.Classic, also referred to as Poppy by VicodinES. The embedded text confirms its nature, mentioning 'Excel Formula Macro Virus' and 'Hydrocodone/APAP 10-650 For Your Computer'. The virus's intent is to infect other workbooks and likely spread its payload.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.