XL4Poppy — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 be0a916d4b8a1593…

MALICIOUS

Office (OLE) / .XLS

1.13 MB Created: 2009-07-07 11:14:15 Authoring application: Microsoft Excel
MD5: 13b6b88e4e3d0093fc9dda1166feb507 SHA-1: a5ef493006561228ebaecaed4e160093fde97e61 SHA-256: be0a916d4b8a1593d681116bc946b49ab16857ddb872cf372f058a47a5de8eb5
180 Risk Score

Malware Insights

XL4Poppy · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1547.001 Registry Run Keys / Startup Folder

The sample is identified as a legacy Excel 4.0 (XLM) macro virus, specifically the XL4Poppy variant, by multiple critical heuristic firings. The document body indicates the virus's intent to infect other workbooks and save them as 'Book1.xls' in the 'xlstart' directory, suggesting an attempt at persistence. The presence of markers like 'XL4Poppy', 'Normal_MacroVirus', and 'Poppy by VicodinES' further confirms its family and nature.

Heuristics 3

  • Excel 4.0 (XLM) Auto_Open + macro sheet critical OLE_XLM_AUTOOPEN
    Workbook contains an Auto_Open / Auto_Close defined name together with an Excel 4.0 macro sheet — the canonical XLM auto-execution shape used by malware families such as Emotet and QakBot.
  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Legacy XLM macro-virus family marker critical OLE_XLM_LEGACY_MACRO_VIRUS
    Workbook contains an Excel 4.0 macro Auto_Open chain and legacy macro-virus family strings. This is a narrow indicator for infected XLM workbooks rather than ordinary formula use.

Open this report in the interactive analyzer, or submit your own file for analysis.