Office (OLE) malware analysis — malicious · 693cded8e5512edb

MALICIOUS

Office (OLE)

15.5 KB Created: 2003-07-12 20:09:25 Authoring application: Microsoft Excel

MD5: 211f1da291726e66f57ba77c03d87a5c SHA-1: 89f3a28039ce27e755fc20e5d2112c98371705f5 SHA-256: 693cded8e5512edb078d3e31f8a017de3ff7e4dc914222b5aa872317b10a65a7

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file is an Excel document containing VBA macros, specifically an Auto_Open macro designed to copy itself to the Excel startup directory as 'StartUp.xls'. It also attempts to establish persistence by hooking sheet activation and key presses, likely to maintain its presence and evade detection. The presence of Auto_Open and the self-copying behavior strongly suggest a persistence mechanism.

Heuristics 4

ClamAV: Xls.Trojan.Escape-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Trojan.Escape-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b1dc6e799f600e1fe03c12ee5c927d9c20e72385747b65f9e697c96da1cbf849`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1767 bytes
Detection ClamAV: Xls.Trojan.Escape-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.