Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 5a74d40bc53d9523…

MALICIOUS

Office (OLE) / .XLS

246.0 KB Created: 2020-09-14 21:28:14 Authoring application: Microsoft Excel
MD5: b7f735b9cd55c1899b7f90149debd28c SHA-1: 5c1e850d96a85efeab698bf00effebd926565731 SHA-256: 5a74d40bc53d9523af5bdb288339c6e01a487c24a05562f248287477852e9a39
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel 4.0 macro sheet that is encrypted, which is a strong indicator of malicious intent. The presence of an 'AUTOOPEN' macro suggests that code execution is intended to occur automatically when the document is opened. The encrypted nature of the macros prevents further static analysis of their specific functionality.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.