Office (OLE) / .XLS malware analysis — malicious · a041a5ed8dabcbd8

MALICIOUS

Office (OLE) / .XLS

150.5 KB Created: 1997-01-08 22:48:59 Authoring application: Microsoft Excel

MD5: 94a9d214b85286ed8158442a5377a786 SHA-1: 1801de4aac5d44b6457f6b9a20a9bc43a000eb43 SHA-256: a041a5ed8dabcbd8be068c9ce8f61cb937c38136718ce7e4c255215941789e75

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.001 PowerShell

The file is an Excel spreadsheet containing a high-severity Auto_Open macro, indicating it's designed to run malicious code automatically when the document is opened. The presence of VBA macros and the Auto_Open heuristic strongly suggest this is a macro-based malware delivery mechanism. The document body content appears to be a legitimate-looking purchase order, likely a lure to encourage the user to enable macros. No specific IOCs were extracted, but the presence of the Auto_Open macro is a critical indicator of malicious intent.

Heuristics 3

Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f44fae8265e2e74b26d5b538a408006a07a7ee06a99afa284006dbce706568e2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	21945 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.