Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 968c69e765d449a6…

MALICIOUS

Office (OLE) / .XLS

840.0 KB Created: 2005-07-17 06:36:40 Authoring application: Microsoft Excel
MD5: fde91e9310d05edf7eeda4bb0fea0dd7 SHA-1: 7bd06bc99b444fabf9ea6c2a27655d30eec3adf5 SHA-256: 968c69e765d449a60ebe60fc47047340b5e1f117a08fe3668be087b1ca065dad
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a legacy Excel formula macro virus, specifically 'XF.Classic' and 'Poppy by VicodinES'. The embedded document body contains text related to inventory and school supplies, likely serving as a lure. The heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' directly indicates the presence of a known macro virus. The file attempts to infect other workbooks by saving itself as 'Book1.xls' in the 'xlstart' directory.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.