Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b0c7442b0c8786fc…

MALICIOUS

Office (OLE)

351.5 KB Created: 2020-07-13 11:03:58 Authoring application: Microsoft Excel First seen: 2020-09-15
MD5: 72cdd0ffed05a13484fc3a89e6ae4511 SHA-1: 89f3f32b566f12a3d8c48207231344c1e3c13bfe SHA-256: b0c7442b0c8786fc0157965af51da0a4ca6a3b767f2fe89985851e685cf5b279
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file identified as malicious, containing an encrypted Excel 4.0 macro sheet. The presence of OLE_XLM_ENCRYPTED_MACROSHEET and OLE_XLM_AUTOOPEN heuristics indicates that the macro sheet is likely designed to run automatically, suggesting an attempt to execute arbitrary code. No specific IOCs were extracted, and the document body was unreadable.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.