Office (OLE) / .EXE malware analysis — malicious · 7af4a35937c2c1ab

MALICIOUS

Office (OLE) / .EXE

71.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel

MD5: bed80209394566dc39ffc1b2a660a8c1 SHA-1: 8d7e0024726afd8e302d47a91fc0eeb11936e011 SHA-256: 7af4a35937c2c1abbb8fe4b63ae9d5b60064bad3f132549875dbddc0dcdd9cc8

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Bulet-1. Static analysis detected VBA macros, including an Auto_Open macro, which is a common technique for executing malicious code upon opening the document. The presence of obfuscated VBA code in macros.bas further supports the malicious nature of the file. The document body contains strings that appear to be related to the malware's naming or internal structure.

Heuristics 6

ClamAV: Xls.Trojan.Bulet-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Trojan.Bulet-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `008d4e8b9eb66abb8c1467528ad8f0f96d3caf80de73df5c2b43c9503c10deb9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	35134 bytes
Detection ClamAV: Xls.Trojan.Bulet-1 Obfuscation or payload: likely Carved artifact contains 107 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.