Office (OLE) / .XLS malware analysis — malicious · 51df8dbd84d38318

MALICIOUS

Office (OLE) / .XLS

826.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel

MD5: 5ce0230125d6cd6ed936b1e10ab03a9c SHA-1: 53bfa7f071b17c108cff45d69b74f8f36e6fed9f SHA-256: 51df8dbd84d3831889b6ade693f942a9b18100f1e2fef0f548ccc1af87e64909

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

This XLS file contains VBA macros, indicated by the OLE_VBA_MACROS heuristic. The SE_ENABLE_LURE heuristic confirms the presence of a macro-enable lure, a common social engineering tactic. The OLE_VBA_CREATEOBJ and OLE_VBA_CALLBYNAME heuristics suggest the macros are designed to execute arbitrary code. While no specific second-stage payload URL was extracted, the presence of macros and the lure strongly indicate a downloader or droppper functionality. The ClamAV detection further supports its malicious nature.

Heuristics 6

ClamAV: Xls.Malware.Exvk-9785252-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Exvk-9785252-0
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
CallByName call high OLE_VBA_CALLBYNAME

CallByName call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `431b5eeffb7b3dac7e5f3fa28ab3ad5c6246b2262314050ad4709f6f7eef07c8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3818 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.