Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 83c4b3decec6e0cc…

MALICIOUS

Office (OLE) / .XLS

171.5 KB Created: 2005-12-16 01:15:32 Authoring application: Microsoft Excel
MD5: ef3bb904b2e516ce23bd27c72704408f SHA-1: 3de1d34092a124c58946a5a269e3d5f2cad8f14a SHA-256: 83c4b3decec6e0cccdb4df9159df11d87af3cb690a7bba002fbcf2e0594805b7
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' directly identifies this file as a legacy Excel formula macro virus, specifically mentioning 'Poppy by VicodinES' and 'The Narkotic Network'. The document body contains strings related to infection, such as 'Add New Workbook, Infect It, Save It As Book1.xls' and 'Infect Workbook', indicating its malicious intent. The presence of 'Hydrocodone/APAP 10-650 For Your Computer' suggests a potential secondary payload or lure.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.