Malicious Office (OLE) / .X — malware analysis report

Static analysis result for SHA-256 7a9b12369a73d46e…

MALICIOUS

Office (OLE) / .X

1.08 MB Created: 2004-06-14 14:33:30
MD5: f10bf99748e048bbf487a4d25789536d SHA-1: 61aede9e6b44dc7d471fd2cf30df5678928b0e24 SHA-256: 7a9b12369a73d46e307569a881ce96efa18c134d5c644ea945e4b8aedf6b7098
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file exhibits critical heuristic firings indicating the presence of legacy Excel 4.0 (XLM) macros, specifically related to Auto_Open functionality and known macro virus markers like 'Poppy' and 'Narkotic Network'. These macros are designed to execute malicious code upon opening the document, likely for further exploitation or payload delivery.

Heuristics 3

  • Excel 4.0 (XLM) Auto_Open + macro sheet critical OLE_XLM_AUTOOPEN
    Workbook contains an Auto_Open / Auto_Close defined name together with an Excel 4.0 macro sheet — the canonical XLM auto-execution shape used by malware families such as Emotet and QakBot.
  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Legacy XLM macro-virus family marker critical OLE_XLM_LEGACY_MACRO_VIRUS
    Workbook contains an Excel 4.0 macro Auto_Open chain and legacy macro-virus family strings. This is a narrow indicator for infected XLM workbooks rather than ordinary formula use.

Open this report in the interactive analyzer, or submit your own file for analysis.