Office (OLE) / .XLSX malware analysis — malicious · 8d67a60489fd037f

MALICIOUS

Office (OLE) / .XLSX

196.0 KB Created: 2005-09-08 14:31:37 Authoring application: Microsoft Excel First seen: 2023-02-06

MD5: d073f64c3bf2f8ce5810eb0bf2270c78 SHA-1: e9a808d5eb0a5c3f66bf38ed4630c0547ca8b5db SHA-256: 8d67a60489fd037f5a4fe6831e8d7d5d57bdef914908aa08337f47db6057a5eb

160 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic

The sample is a macro-enabled Excel file detected as malicious by ClamAV. The Auto_Open macro attempts to establish persistence by copying the workbook to the Excel startup folder ('XLSTART') as 'mypersonel.xls' and setting an AutoSheetActivate event to run 'mypersonnel.xls!allocated' on subsequent openings. The Auto_Close macro attempts to convert the file to an older XLS format and delete the original XLSX.

Heuristics 4

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d49b3eed57ea333340314eacd5bf3454f6a2ba3085f3bfa723034dd1a2d97cfb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1510 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.