[SANS ISC] A Safe Excel Sheet Not So Safe

I published the following diary on isc.sans.edu: “A Safe Excel Sheet Not So Safe“:

I discovered a nice sample yesterday. This excel sheet was found in a mail flagged as “suspicious” by a security appliance. The recipient asked to release the mail from the quarantine because “it was sent from a known contact”. Before releasing such a mail from the quarantine, the process in place is to have a quick look at the file to ensure that it is safe to be released. The file is called ‘Info01.xls’ (SHA256:89e6e635c1101a6a89d3abbb427551fd9b0c1e9695d22fa44dd480bf6026c44c) is a VT score of 0/59. Yes, you read it correctly, it remains undetected by antivirus solutions… [Read more]