Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 c991dac6a16779a7…

MALICIOUS

Office (OLE) / .XLS

195.5 KB Created: 2021-02-23 19:30:51 Authoring application: Microsoft Excel
MD5: 815c32268dc01f5fd7669fe4fbd00ca7 SHA-1: 947caf8da9b9b9753c5db04393f1564a3f8a428a SHA-256: c991dac6a16779a735da29041baeadc4efdab83c186cf3f82d8815fcf6b07706
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The presence of an encrypted Excel 4.0 macro sheet (OLE_XLM_ENCRYPTED_MACROSHEET) strongly suggests malicious intent. The auto-open macro (OLE_XLM_AUTOOPEN) further supports this, as it is commonly used to execute malicious code immediately upon file opening. The document body was unreadable, preventing further analysis of the specific lure or payload.

Heuristics 2

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.