Office (OLE) / .XLS malware analysis — malicious · d7f28eee37baa1ab

MALICIOUS

Office (OLE) / .XLS

30.0 KB Created: 2009-03-30 06:24:02 Authoring application: Microsoft Excel

MD5: ce7d8d3204d87ecf0a1b39eb184aef3d SHA-1: c941c0f0c1ee7f982a4d0c641383d5c81abadeba SHA-256: d7f28eee37baa1ab54b76d12bb3b29a3e8a6dd1a5b79da482851b441d40e7915

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an Excel spreadsheet identified as malicious by ClamAV with multiple heuristic firings indicating the presence of VBA macros, including an Auto_Open macro. The embedded VBA macros are likely responsible for executing the malicious payload. The document body contains what appears to be financial data, possibly serving as a lure.

Heuristics 4

ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dc7064d775443ce095d0598c72b0d787d2153f42eea5eb41b533e822b9afda36`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2292 bytes
Detection ClamAV: Xls.Trojan.Escape-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.