Office (OLE) / .XLSX malware analysis — malicious · 62b69ae5bd7841ca

MALICIOUS

Office (OLE) / .XLSX

604.0 KB Created: 2015-03-17 06:43:26 Authoring application: Microsoft Excel First seen: 2023-02-06

MD5: 88886bb62f60a150b95fafbd68496361 SHA-1: 4b2d0a95e1984623f583efc7e627a5e139f8647e SHA-256: 62b69ae5bd7841ca43f1f57fff05de7d2f168b595a1578fdfb6bf90e970a3875

160 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros, specifically an Auto_Open macro, which is designed to execute automatically when the Excel file is opened. This macro saves a copy of itself to the Excel startup directory (XLSTART) as 'mypersonel.xls' and also sets up an Auto_Close macro. This indicates an attempt to establish persistence on the victim's machine by ensuring the malicious macro runs whenever Excel is launched. The ClamAV detection further confirms its malicious nature.

Heuristics 4

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d49b3eed57ea333340314eacd5bf3454f6a2ba3085f3bfa723034dd1a2d97cfb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1510 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.