File scan report
Verdict Suspicious
Is this Excel spreadsheet safe? Treat it as suspicious.
ESET alone identified this spreadsheet as a phishing document, but 74 of the 65 antivirus engines that checked it did not flag it and no corroborating evidence exists.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (ESET) flags it as phishing; nothing else confirms it.
Limited evidence
What to do now5 steps
This spreadsheet may be a phishing lure. Opening it by itself is unlikely to infect your device; the risk is the links inside it.
What to do
Don't click links or buttons in this spreadsheet, and don't enter a password on any page it opens.
Check with the sender using a phone number or email address you already have, not the details in this spreadsheet.
If you typed a password after opening it, change that password now and turn on two-step verification.
If you entered card or bank details, call your bank using the number on your card.
If you already opened it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 65 flagged
- Flagged 1
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Not run
- First seen 13d ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
ESET-NOD32 flagged the spreadsheet as DOC/Phishing.Agent.DMM, while none of the other 74 engines did. Because the file is and lacks sandbox results or independent threat-intelligence corroboration, treat it cautiously until its source and contents are verified.
One of the 65 antivirus engines that checked it flagged the spreadsheet, with ESET-NOD32 assigning a specific phishing-document label. The remaining 74 engines did not flag it, and there is no multi-engine family consensus. Independent research sources produced no matching malware rules or known sample record, which makes a false positive plausible. However, the file has only one known submission and was first observed on Oct 13, 2026, so its limited reputation weakens reassurance from the low detection count. No completed observation from the test run or comprehensive contacted-host check is available, leaving the suspected phishing behavior unconfirmed.
What We Detected
ESET-NOD32 identified the spreadsheet as DOC/Phishing.Agent.DMM. It was the only detector among 75 engines to flag the file, so there is no multi-engine agreement on that classification.
Threat Behavior
No completed sandbox observation is available, so the file's activity in the test run was not observed. No comprehensive contacted-host reputation result is available either. Independent research sources found no matching malware-specific rules or known sample entry, but those absences do not prove the document is harmless.
What To Do Now
Do not enable external content, follow embedded links, or provide credentials based on this document. Confirm the sender and expected purpose through a separate trusted channel, and open it only in a protected or isolated environment if business use requires inspection.
Where this verdict could be wrong2 caveats
- ESET-NOD32 is a major antivirus engine and specifically identifies a phishing document, so its isolated detection should not be dismissed.
- Five similar records were previously assessed as benign, but they share only the broad spreadsheet file type and are not close identity matches.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only one of the 65 antivirus engines that checked it flagged the spreadsheet.
- There is no multi-engine consensus on a phishing family.
- Independent research feeds returned no malware-specific rule or known sample match.
- No malicious file it created was reported.
- A major antivirus engine identified the document as a phishing agent.
- The spreadsheet was first observed on Oct 13, 2026 and has only one known submission.
- No completed sandbox run is available to determine whether it presents links, forms, or other phishing content.
- No complete reputation check exists for any hosts that the document might contact.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
1 of the 65 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- ESET-NOD32 (major engine)DOC/Phishing.Agent.DMM trojan
File fingerprint
- File name
- Excel spreadsheet
- Format
- Office Open XML Spreadsheet
- Size
- 104.5 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 13, 2026, 8:43 AM UTC
- SHA-256
019926bd1400605dd2667a02b3cd14186febcae99a7f71ebb957a80a960a1ba6- SHA-1
95ec903723b7a7d30da6a340a62b9926b31fd25f- MD5
cb342ee9a4ae2d9475bbcb8f8655e210
First scanned
Antivirus consensus
1 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines1flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- ESET-NOD32Malicious: DOC/Phishing.Agent.DMM trojan
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 1 antivirus detection make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this Excel spreadsheet safe, or is it malware?
What is this Excel spreadsheet?
How many antivirus engines detected this Excel spreadsheet?
I already downloaded and opened this Excel spreadsheet — what should I do?
What is the SHA-256 hash of this Excel spreadsheet?
How up to date is this analysis of this Excel spreadsheet?
Community
Member reviews and reports for this exact file hash.