Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 59cc31a943e19100…

MALICIOUS

Office (OLE) / .XLS

118.0 KB Created: 2000-05-26 16:45:09 Authoring application: Microsoft Excel
MD5: 6e0db9f5aa992d87e64ca77578fa0a45 SHA-1: e9037c5883a78771312054bdd2a75645ec5f19fa SHA-256: 59cc31a943e1910078b98b1ba04322eb9466b08e45f3b05c2eda7488e46b75f3
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.002 Spearphishing Attachment

This XLS file contains both Excel 4.0 macros and VBA macros, with a critical ClamAV detection indicating it is malicious. The presence of VBA macros, including API declarations for interacting with the Windows API (e.g., WritePrivateProfileString, GetWindowsDirectory), suggests the potential for system modification or payload execution. The XLM macros also indicate macro-based execution. While no specific URLs or executable payloads were directly extracted, the combination of macro types and the critical detection strongly suggests a downloader or droppper functionality, aiming to fetch and execute further malicious content.

Heuristics 3

  • ClamAV: Xls.Malware.Generic-6680536-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Generic-6680536-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
c4a283288b9a93214fe0a036d1e85954cbf31889012461275694d07f2372e0bc		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 70133 bytes
macros.bas
322c94d84628f441b87d3472303a7414fd51c5c11c21f04c83891d48de7a57f8		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.