Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ec731be76a086abe…

MALICIOUS

Office (OLE)

371.5 KB Created: 2020-04-01 21:39:42 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 05faa6b8896a683d29c1c8a6086371fd SHA-1: 3e2e6ebb4895da2ea0d7463a1a90e2130fb1335c SHA-256: ec731be76a086abeb648d187a0925ff71d9eec2e65f2325486e3dc23afcaf7c8
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an encrypted Excel 4.0 macro sheet, indicated by multiple heuristic firings including OLE_XLM_ENCRYPTED_MACROSHEET and OLE_XLM_AUTOOPEN. This suggests the document is designed to execute malicious macros upon opening, a common technique for delivering secondary payloads. The presence of encrypted macros and the use of older Excel macro technology point towards a downloader or initial access mechanism.

Heuristics 3

  • OLE metadata lists many Excel 4.0 macro sheets high 2 related findings OLE_XLM_DOCPROPS_MACROSHEET_INVENTORY
    Workbook contains a BIFF Excel 4.0 macro-sheet marker and its clear OLE DocumentSummaryInformation stream lists many MacroN sheet titles. This is a useful static signal when FILEPASS encryption prevents formula extraction from the workbook stream.
  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.