Office (OLE) malware analysis — malicious · fd018d0b8e4f0671

MALICIOUS

Office (OLE)

26.0 KB Created: 1998-11-13 15:47:39 Authoring application: Microsoft Excel First seen: 2012-06-14

MD5: fb6968af4805bb7d4d674bb147fd040f SHA-1: 0f7debc0063d747f9e5f4eb4c581b2bf786ed91d SHA-256: fd018d0b8e4f06714fd8aab67b2e996d5298dde2ddb3bb40dc5ecfac3111bee6

142 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains Excel 4.0 macros (XLM) with an Auto_Open routine, a common technique for malicious macro-enabled documents. The heuristic 'OLE_XLM_AUTOOPEN_PAYLOAD_LURE' indicates the presence of a payload URL, specifically http://sourceofkaos.com/homes/nomercy/crazh.html, suggesting the macro's intent is to download and execute a second-stage payload. The ClamAV detection 'Win.Trojan.Crazy-2' further supports its malicious nature.

Heuristics 4

ClamAV: Win.Trojan.Crazy-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Crazy-2
XLM Auto_Open workbook with payload URL or enable-content lure critical OLE_XLM_AUTOOPEN_PAYLOAD_LURE

Workbook contains an Excel 4.0 macro sheet with Auto_Open / Auto_Close and also exposes a payload URL or enable-content lure in the OLE bytes. This combination is a high-confidence XLM downloader/social-engineering pattern even when formula recovery cannot decode the full macro chain.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://sourceofkaos.com/homes/nomercy/crazh.html Referenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.