Office (OLE) / .XLSX malware analysis — malicious · 97b7c1f07a298273

MALICIOUS

Office (OLE) / .XLSX

192.5 KB Created: 2011-12-12 01:36:43 Authoring application: Microsoft Excel First seen: 2023-02-08

MD5: e77733eaf39be4c0c617ca0d04de7e92 SHA-1: ecfec5905eb8cad7e4bb2ab250eaf2e068762475 SHA-256: 97b7c1f07a298273b65fd89ca73a0d9315b8e864df0dc8f71ea982151872a2ce

160 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic

The file contains VBA macros, including Auto_Open and Auto_Close, indicating malicious intent. The Auto_Open macro attempts to save a copy of itself to the XLSTART folder as 'mypersonel.xls' or 'mypersonnel.xls', establishing persistence. The Auto_Close macro attempts to convert the file to an older .xls format and delete the original .xlsx, likely to evade detection or ensure compatibility with its persistence mechanism. The ClamAV detection further confirms its malicious nature.

Heuristics 4

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0e027d7c75d49f79cc7aa4389acfebf7b55f41d2ad86258589318b07847f19ae`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.