Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a454e662a24e5baa…

MALICIOUS

Office (OLE)

38.5 KB Created: 2006-07-09 13:36:38 Authoring application: Microsoft Excel
MD5: 01da778f49c6feb4a5fd98a6e07dc77b SHA-1: 62d2517e7957d44217b394c74cb8127a00364e78 SHA-256: a454e662a24e5baa82c52cfaccf7236fa0c9928597492b417ef279bd8c0bf5ec
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The file is identified as a legacy Excel formula macro virus, specifically 'Classic.Poppy by VicodinES'. The document body presents a price quote for chemicals, which appears to be a lure. The presence of the 'OLE_XLS_FORMULA_MACRO_VIRUS' heuristic firing strongly indicates the execution of malicious macro code within the Excel file, likely to perform an unknown secondary action.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.