Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b15e1489a7b3a4fb…

MALICIOUS

Office (OLE)

628.0 KB Created: 2010-06-11 03:52:47 Authoring application: Microsoft Excel
MD5: f791db2d64244a6dc931feb2d3b39c7e SHA-1: 265bc993f6ab2b59dc767dc148765e3b83c53a66 SHA-256: b15e1489a7b3a4fb2b17efccb1789a6f10e5f8a23e07ee68325703681cf10db2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a legacy Excel formula macro virus, specifically 'XF.Classic' by 'VicodinES' and 'Poppy'. The document body contains text that appears to be a fake pharmaceutical advertisement for 'Hydrocodone/APAP 10-650' and mentions infecting other workbooks, suggesting a delivery mechanism for malicious content. The presence of the 'OLE_XLS_FORMULA_MACRO_VIRUS' heuristic firing strongly supports this assessment.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.