Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8ebe652ff95b28d3…

MALICIOUS

Office (OLE) / .XLS

76.0 KB Created: 2020-12-15 12:07:20 Authoring application: Microsoft Excel
MD5: 4a1c55d81f0e66cfe10e178087ee2936 SHA-1: bff1954286bed056fe3209c9a82b4881a7a0ba57 SHA-256: 8ebe652ff95b28d304a5da8ecb05c21d6aa37cb3c59abbadca089046a8390075
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel 4.0 macro sheet that is encrypted, preventing deeper analysis of its specific functionality. The presence of encrypted macros and the 'AUTOOPEN' heuristic strongly suggest malicious intent, likely to download and execute a secondary payload. However, without the ability to decrypt the macros, the exact attack vector and IOCs remain unknown.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.