Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 93aff3f51d478fff…

MALICIOUS

Office (OLE)

21.5 KB Created: 2010-04-14 04:47:33 Authoring application: Microsoft Excel
MD5: 8f309ada54a04a85b3415d838bf5ff75 SHA-1: c25297f5eacdd681f01de29b16b5169a56585bf7 SHA-256: 93aff3f51d478fff5a89d442c5893c07a67d52c33f4bc4e776e59830b691b814
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a legacy Excel formula macro virus, specifically 'XF.Classic' by 'The Narkotic Network'. The document body contains strings related to this virus, including its name, author, and a reference to 'Hydrocodone/APAP 10-650', suggesting a potential lure or payload component. The virus appears to infect new workbooks and save them as 'Book1.xls'.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.