Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 c553aa5c7909bd9a…

MALICIOUS

Office (OLE) / .XLS

2.97 MB Created: 2000-05-26 16:45:09 Authoring application: Microsoft Excel
MD5: f37b0f452d3a4b8f46ec6548c69867c6 SHA-1: 10826ef4bca16dc2c5ee2a2d7c846a495bdfc907 SHA-256: c553aa5c7909bd9a7e7cc1f6e4f3f9380a8ec5d69d82e75af4092a8de96f57fb
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains both VBA and Excel 4.0 (XLM) macros. The XLM macro sheet marker at offset 0x1E116A indicates the presence of older macro technology, often used for initial execution. The VBA macros include declarations for Windows API functions like WritePrivateProfileString, GetWindowsDirectory, and GetSystemDirectory, suggesting potential system interaction or configuration manipulation. The document body contains what appears to be construction or material cost data, likely a lure to disguise the malicious intent. The combination of these factors points to a macro-based attack, possibly for phishing or credential theft.

Heuristics 3

  • ClamAV: Xls.Malware.Generic-6680536-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Generic-6680536-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
ee2635b795c02203e593b0176996e3543dcc34faf24e7462fe2cba0de76683da		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 3267443 bytes
macros.bas
f1a0a1924498708ffcd80c76cbe0099a7455fcbadc042a137c46e5b69a1d37b8		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 9033 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.