Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 874a53d733070900…

MALICIOUS

Office (OLE)

252.0 KB Created: 2002-03-01 14:45:24 Authoring application: Microsoft Excel First seen: 2015-09-30
MD5: 94fa911c7654d7c9ff1136c28e714870 SHA-1: 9dc7d118151cc6a497a037ce58734bfbe69ee2a9 SHA-256: 874a53d73307090087cfbf33550220932325c8749e4e8a7608ca477e7075cc2a
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a legacy Excel formula macro virus, specifically 'Classic.Poppy by VicodinES' from 'The Narkotic Network'. The embedded VBA macros and document body indicate an intent to infect other workbooks, likely by saving infected copies to the Excel startup directory (xlstart). This behavior suggests a self-propagating malware.

Heuristics 2

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1301 bytes
SHA-256: 617f9aa5edf925560c0c326553d47d19a584ce75e27f9e5f14ec4e48132aa0c7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Sub SVREPORTS()
    Sheets("SV REPORTS").Select
End Sub

Attribute VB_Name = "Sheet19"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet18"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.