Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 eaa32259a0c2dac3…

MALICIOUS

Office (OLE) / .XLS

307.0 KB Created: 2002-10-21 00:42:14 Authoring application: Microsoft Excel
MD5: bb3eb37f75dc8304ec38c6ad712252b7 SHA-1: a7009b6e3ac3ef9f45e8a687052d85fb1098e85a SHA-256: eaa32259a0c2dac3f995ee4a1a79f94da89020b12ad342c34bbf532486eb801b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The critical heuristic firing indicates this is a legacy Excel formula macro virus, specifically identified as 'XF.Classic' and attributed to 'VicodinES' and 'The Narkotic Network'. The document body contains text related to tax and financial reporting, likely a lure to disguise the malicious nature of the embedded macro. The script sections confirm the presence of macro virus markers and mention 'Hydrocodone/APAP 10-650 For Your Computer', suggesting a potential social engineering pretext.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.