Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 5282482a94ea2201…

MALICIOUS

Office (OLE) / .XLS

998.5 KB Created: 1999-03-17 16:40:35 Authoring application: Microsoft Excel
MD5: 1ce4b02ff5875f118a18aef71fe3afec SHA-1: 16d1f8b3d242ca8415437e0c852742c3185e7cb7 SHA-256: 5282482a94ea22011a2e46bef59d83177c7e9127bcc48cbca9cf8b049a0f5acd
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1547.001 Registry Run Keys / Startup Folder

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' and the medium heuristic 'OLE_XLM_AUTOOPEN' indicate the presence of legacy Excel macros. The 'DOC BODY' contains strings like 'Add New Workbook, Infect It, Save It As Book1.xls' and paths such as 'C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\xlstart\Book1.' and 'C:\Documents and Settings\SD7\Application Data\Microsoft\Excel\XLSTART\Book1.', suggesting the macro's intent is to infect other Excel files and potentially establish persistence by placing copies in XLSTART folders. The specific markers like 'Poppy by VicodinES' and 'Narkotic Network' are also indicative of older macro malware.

Heuristics 2

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.