MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
The file is a password-encrypted Excel spreadsheet, which is a common delivery mechanism for malware. ClamAV detection indicates it is a downloader, likely intended to fetch and execute a secondary payload. The encryption prevents further static analysis of the document's content or embedded scripts.
Heuristics 3
-
ClamAV: Xls.Downloader.94c25b356b5a6cac-9978798-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Downloader.94c25b356b5a6cac-9978798-0
-
Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGEOLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
-
Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXMLOLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.
Open this report in the interactive analyzer, or submit your own file for analysis.