Office (OLE) / .EXE malware analysis — malicious · e58046b8ea435f17

MALICIOUS

Office (OLE) / .EXE

47.0 KB Created: 2001-03-02 13:09:09 Authoring application: Microsoft Excel

MD5: 2ffba341c00f18dca8788b72c0339003 SHA-1: 0963e9d536742c5428b6e0cdd13860e281e2a9df SHA-256: e58046b8ea435f170c6788576d493aa0c577031a0bc9d4935b8df78b46eb637f

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Xls.Trojan.DMV-3. Static analysis revealed the presence of VBA macros, specifically an Auto_Close macro, which is a common technique for executing malicious code upon closing the document. The extracted VBA code, while partially obfuscated, indicates an intent to manipulate workbooks and potentially copy modules, suggesting a downloader or backdoor functionality.

Heuristics 5

ClamAV: Xls.Trojan.DMV-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Trojan.DMV-3
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c777681468538f508cc2c886984a8fc68ca5cd75aad15f0dc10669dff27b074e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4281 bytes
Detection ClamAV: Xls.Trojan.DMV-3 Obfuscation or payload: likely Carved artifact contains 10 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.