XF.Classic — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 ed9a732b15638092…

MALICIOUS

Office (OLE) / .XLS

101.0 KB Created: 1999-02-08 02:12:02 Authoring application: Microsoft Excel
MD5: 801edd3ef92992a2402495e66ee31287 SHA-1: 864a547f09e8c999ea1cc7b6dbc7b2f8396f2a7e SHA-256: ed9a732b156380929cd9418a917e66a51f29a7a5ff175afefaca4878438cdee6
60 Risk Score

Malware Insights

XF.Classic · confidence 95%

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The heuristic firing 'OLE_XLS_FORMULA_MACRO_VIRUS' directly identifies this file as a legacy Excel formula macro virus, specifically mentioning 'XF.Classic' and 'Poppy by VicodinES'. The document body contains strings related to infection and payload delivery, such as 'Add New Workbook, Infect It, Save It As Book1.xls' and 'Hydrocodone/APAP 10-650 For Your Computer'. This indicates the primary function is to spread itself and potentially deliver a secondary payload.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.