XF.Classic — Office (OLE) / .XLK malware analysis

Static analysis result for SHA-256 58a976bea2438f90…

MALICIOUS

Office (OLE) / .XLK

470.0 KB Created: 2004-01-05 13:44:13 Authoring application: Microsoft Excel
MD5: bb064fab454710919986ad98d6ffe594 SHA-1: 7846bb44aef56208a0e367f3d320762cbe969a36 SHA-256: 58a976bea2438f909ff1ae4d08fd8b15a17e925f5d2cee74527723cd70de643e
60 Risk Score

Malware Insights

XF.Classic · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' directly identifies this file as a legacy Excel formula macro virus, specifically mentioning 'XF.Classic' and 'Poppy by VicodinES'. The document body contains strings like 'An Excel Formula Macro Virus (XF.Classic)' and 'Classic.Poppy by VicodinES', further corroborating the family and attack pattern. The presence of 'Book1.xls' suggests an attempt to infect or masquerade as a legitimate startup file.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.