Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 fc867cdc65cbab18…

MALICIOUS

Office (OLE) / .XLS

1.22 MB Created: 2008-09-29 01:17:29 Authoring application: Microsoft Excel
MD5: 03ca3d3f63ddd7155d439f97e7aa158b SHA-1: f60b07cca5f9259c4d88d90c44065f783a3b8513 SHA-256: fc867cdc65cbab18bac66b33ce2fc6acd9ffe3407731c6f252338b57733ddeac
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The critical heuristic 'OLE_XLS_FORMULA_MACRO_VIRUS' indicates the presence of a legacy Excel formula macro virus, specifically identified as 'XF.Classic' and associated with 'Poppy by VicodinES'. The embedded text confirms this, mentioning 'Excel Formula Macro Virus' and 'Classic.Poppy by VicodinES'. The script's intent appears to be infecting other workbooks and saving them as 'Book1.xls', suggesting a propagation mechanism. The mention of 'Hydrocodone/APAP 10-650 For Your Computer' is unusual and may indicate a secondary malicious purpose, though the primary function is macro-based infection.

Heuristics 1

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.

Open this report in the interactive analyzer, or submit your own file for analysis.