Office (OLE) / .XL malware analysis — suspicious · 881e0af506baae1e

SUSPICIOUS

Office (OLE) / .XL

2.58 MB Created: 2006-12-27 10:06:15 Authoring application: Microsoft Excel

MD5: 69dfd4f0b60d09eab6861cdcfa8dc1a3 SHA-1: 8db133b1103763e84c31febfd65d96399435d9ad SHA-256: 881e0af506baae1e1801d3f1441c0e6ff649bca741f6c835ee1d81178c51337a

40 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel spreadsheet containing VBA macros, specifically a Workbook_Open macro that prompts for a password. This macro is designed to execute automatically when the workbook is opened, potentially to obscure malicious activity or to lure the user into providing credentials. The macro's behavior suggests an attempt to manipulate user interaction within the spreadsheet.

Heuristics 3

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro capabilities present but unconfirmed info MACRO_CAPABILITY_UNCORROBORATED

The document's VBA exposes execution capabilities (Shell/WScript/CreateObject/auto-exec) but nothing corroborates malicious intent — no obfuscation, memory-exec primitive, download+exec chain, encoded payload, LOLBin, DDE, AV hit, or suspicious URL. The verdict was capped at 'suspicious' so legitimate macro-heavy business documents are not flagged malicious on capability presence alone.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `95656f604ce12f646a41217914b4f2304bc30a4546f118b24ec20a1bdb57be44`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	60980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.