Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 aaf10e5da95d8a65…

MALICIOUS

Office (OLE) / .XLS

1.76 MB Created: 2005-03-25 21:05:45 Authoring application: Microsoft Excel
MD5: 0a31dd1aa66f93ed1c4bac61ab12deda SHA-1: f9c731b24e408720ae44cc85c4a174138846c027 SHA-256: aaf10e5da95d8a65ac780aff4e6bab9c86f600258a33f7f3c4eb8d0707e34bbf
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' indicates this is a legacy Excel formula macro virus, specifically identified as 'Classic.Poppy by VicodinES' and 'The Narkotic Network 1998'. The document body contains VBA script comments indicating actions such as 'Add New Workbook, Infect It, Save It As Book1.xls', suggesting the macro's intent is to infect other Excel files and potentially establish persistence by saving to XLSTART directories. The presence of strings like 'Hydrocodone/APAP 10-650 For Your Computer' may indicate a lure or payload theme.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.