Managed XDR

spreadsheet.xls — malware analysis report

File info

Filename
spreadsheet.xls
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Last Saved By: Bruno, Revision Number: 1, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Dec 17 01:32:42 1996, Last Saved Time/Date: Wed Jun 25 02:38:15 2025, Number of Pages: 0, Number of Words: 0, Number of Characters: 0, Security: 0
File size
114.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
7aa2690cc575422349cb4b6d9249c07c8375f09e
SHA256
a284e782228afc0833045a452c0714b4bccb212ef7cc1183e57456e1c6a0824d
MD5
625e2212be06333163a16fef5968cb2d

Signatures

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 5)
T1064 office_macros_strings: Feature lines found in document macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 5)
T1064 office_macros_strings: Feature lines found in document macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata