Office (OOXML) / .XLSX malware analysis — malicious · e1372381a8b43e24

MALICIOUS

Office (OOXML) / .XLSX

15.6 KB Created: 2026-05-07 04:03:06 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2026-06-22

MD5: 31be02b3dc4ea356901ba1c64bdba9ad SHA-1: a3d2f046d7219705e80e5dc1725a6a671cbe0422 SHA-256: e1372381a8b43e2429678949792b9dc430ef7d8fa258f00a2dda91b958cbca6b

200 Risk Score

Heuristics 3

ClamAV: Eicar-Test-Signature critical CLAMAV_DETECTION

ClamAV detected this file as malware: Eicar-Test-Signature
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	3072 bytes
SHA-256: `3acf9df2fa57cffd4e06a0d726863afce6209c597a33be4ee814c31590127a10`
Detection ClamAV: Eicar-Test-Signature Obfuscation or payload: unlikely
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	614 bytes
SHA-256: `ad9520157f4daddc5042b2296b08c8fc85fe5402c5c610f67d7968852c72c601`
`ooxml_oleobject_00_ole10native_00_eicar.com`	ole-package-payload	OOXML xl/embeddings/oleObject1.bin Ole10Native payload: display_name=eicar.com; full_path=C:\Users\LGMS-J~1\AppData\Local\Temp\{1C86E03B-503F-47F1-B215-0F12B24B650F}\{7DE0531D-8227-40AA-A96B-724D18A55FFC}\eicar.com; temp_path=; def_file=	68 bytes
SHA-256: `275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f`
Detection ClamAV: Eicar-Test-Signature Obfuscation or payload: unlikely
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	7292 bytes
SHA-256: `09ed194f94ad8cd2310efb5a857abce0af488fadcc00b3ff7057bac3290a9ada`

Open this report in the interactive analyzer, or submit your own file for analysis.