Office (OLE) / .XLS malware analysis — malicious · 8e06789e952991e6

MALICIOUS

Office (OLE) / .XLS

71.0 KB Created: 2020-04-27 08:41:50 Authoring application: Microsoft Excel

MD5: b697665a48ca3067425ac423ff3bd532 SHA-1: 8eba62859b7e62eb67fa758fac43f5c481b6be76 SHA-256: 8e06789e952991e6fc483ab0e6bbf08a123922ba354a75c9dc9dcc759c60c194

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing with Other Means

The file is identified as malicious by ClamAV with the signature Xls.Malware.Agent-7700489-0. High-severity heuristics indicate the presence of Windows Script Host references and a CreateObject call, strongly suggesting the execution of malicious code. The VBA macros, totaling 1191 bytes, are the likely mechanism for this execution. While the document body is truncated and contains narrative text, the core malicious functionality is likely within the macros, which are designed to download and execute a second-stage payload.

Heuristics 4

ClamAV: Xls.Malware.Agent-7700489-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Agent-7700489-0
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `9835e69d676b9dd7f553f64682275041f7686192e0e99899a3a634614830f1d9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1191 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.