Office (OLE) / .XLS malware analysis — malicious · cdf7fb73990a588f

MALICIOUS

Office (OLE) / .XLS

215.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel

MD5: cff0e64c4040861569abc676eaffbbcc SHA-1: 853da593d2a489c2bd72a284a362d7c68c3a4d4c SHA-256: cdf7fb73990a588f8fe32029e3b4794e7793b850eda21754a3517a62338f2419

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is a malicious Excel spreadsheet containing a large VBA macro. The presence of an Auto_Open macro and a Shell() call indicates that the macro is designed to execute commands automatically upon opening. The macro likely downloads and executes a second-stage payload, although the specific commands and payload could not be fully reconstructed due to the size and potential obfuscation of the macro code. The extracted artifact 'macros.bas' further supports the presence of malicious VBA code.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ee9d169ba13e31a3fb1657dfeef2342f948d5bae8b95c0064adf8ffa21abaa04`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	958123 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1994 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.