Office (OLE) / .XLS malware analysis — malicious · a9263f30fe818945

MALICIOUS

Office (OLE) / .XLS

182.5 KB Created: 2020-12-02 11:49:46 Authoring application: Microsoft Excel

MD5: 27e305bb81cd32464dfee3cbf6b78730 SHA-1: 7d061fff432e39e958924dd84659e9b9f41d355f SHA-256: a9263f30fe818945fcdc5cbef781400058e012b1605efb63d1d4e4a432d41160

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell

The file is an Excel spreadsheet that contains heuristics indicating PowerShell execution and visible command execution instructions. The embedded URL, although marked as benign, is likely the source for a second-stage payload. The document body is heavily obfuscated and unreadable, preventing further analysis of its specific lure.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://raw.githubusercontent.com/Build87471/ljs0l440ku9r/gh-pages/1pkcwcebyi4.ttf\

Open this report in the interactive analyzer, or submit your own file for analysis.