Office (OLE) / .XLS malware analysis — malicious · b8f203d2feed54ae

MALICIOUS

Office (OLE) / .XLS

1.06 MB Created: 2004-04-27 14:53:07 Authoring application: Microsoft Excel

MD5: ed76e561fd900d14a4fd42b8bbef39ad SHA-1: 947f2b23cb20a23b5c107d012f926a8c4605532d SHA-256: b8f203d2feed54aefe5a881c3864716f304b5a7e068899615b0ce7181e09fea6

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.002 Spearphishing Attachment

The file is an Excel spreadsheet containing a Workbook_Open VBA macro, indicating it's designed to execute code automatically when opened. The macro source is substantial, suggesting complex functionality. While the document body contains what appears to be retail location data, it lacks any clear call to action or context for enabling macros. The primary heuristic indicates the presence of a Workbook_Open macro, which is a common technique for initiating malicious actions upon file opening. No specific IOCs like URLs or hashes were extracted, but the presence of the macro strongly suggests a malicious intent, likely to download and execute a secondary payload.

Heuristics 2

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `72fe894a7e163a27b410155945350051399ca3bb131b64cfb3102108beec3a38`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	317531 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.