Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 67af0f3665d39d54…

MALICIOUS

Office (OLE)

978.0 KB Created: 2001-10-25 01:35:04 Authoring application: Microsoft Excel
MD5: 2255da8f1b204b51f8676f4ca13b3590 SHA-1: 8a538099fdd4649179f5bba4760878b10a3a80d4 SHA-256: 67af0f3665d39d54d8f1e511fcf02bfb05a13144e00518f56d552548cc884d19
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 97-2003 Workbook by a critical heuristic firing indicating a legacy macro virus. The document body contains strings related to this virus, including its name 'Classic.Poppy by VicodinES' and the group 'The Narkotic Network 1998'. The embedded content suggests the macro's purpose is to infect other workbooks and potentially deliver a payload, aligning with the identified Visual Basic technique.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.