Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 683516912ba44027…

MALICIOUS

Office (OLE) / .XLS

166.5 KB Created: 2021-08-09 13:30:37 Authoring application: Microsoft Excel First seen: 2023-09-07
MD5: c4463f09c3c15901a0f50a3d50b963d7 SHA-1: 96deb29b9a5575d8eb0fb1c65680326b3f955285 SHA-256: 683516912ba44027a1d5121d53f176e0ac12f24d6e7c135d5138fbcd9e4c71e4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical ClamAV heuristic identifies the file as 'Doc.Downloader.Donot-10026071-0', indicating a downloader. The high-severity Workbook_Open heuristic confirms that a macro within the workbook is designed to execute automatically upon opening. This macro likely downloads and executes a second-stage payload, consistent with a downloader's behavior.

Heuristics 3

  • ClamAV: Doc.Downloader.Donot-10026071-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Donot-10026071-0
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ebeade07e5820500d32b9c9cef613abadb60bedd34384f094fc21e362975c78e		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 118419 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.