Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 61238d164faf3be8…

MALICIOUS

Office (OOXML)

9.0 KB Created: 2021-07-27 20:40:09 UTC Authoring application: 12.0000 First seen: 2026-06-04
MD5: 72b5f08d8fdb49354633b86307d1ddb7 SHA-1: 2ab1f737e978ade0b36ac0f76ea844292062bac4 SHA-256: 61238d164faf3be8e191f2655c6e1e68f594a324494cc394952cf18e0b970a68
60 Risk Score

Heuristics 1

  • Spreadsheet DDE link launches a dangerous command critical OOXML_SPREADSHEET_DDE_MALICIOUS
    Excel workbook contains an externalLinks/ddeLink entry whose ddeService/ddeTopic launches a dangerous executable. This is SpreadsheetML DDE command execution, distinct from WordprocessingML DDE field instructions.

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.