Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 fdc4d4d584cce4e1…

MALICIOUS

Office (OLE) / .XLS

66.5 KB Created: 2020-04-21 08:14:48 Authoring application: Microsoft Excel
MD5: 49fd01ae576df142c40cc554d5bcf024 SHA-1: 4b680724908fa8fffe94722fc7ff30d010b53cfd SHA-256: fdc4d4d584cce4e11ba154b87a5d654b04a86cf6ad68e339f59b0d6fda6a02b8
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is an Excel spreadsheet containing malicious VBA macros. Heuristics indicate the use of WScript.Shell and Shell() calls, suggesting the macros are designed to execute commands or download additional payloads. The ClamAV detection name 'Xls.Dropper.Agent-7683579-0' further supports its role as a dropper. The document body text appears to be unrelated, likely obfuscation or filler content.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Xls.Dropper.Agent-7683579-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7683579-0
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ae83d32655af6116594beb681a07a4f99d1f404eeb97396cd305f2fce83b2928		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1482 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.