[SANS ISC] A Safe Excel Sheet Not So Safe

I published the following diary on “A Safe Excel Sheet Not So Safe“:

I discovered a nice sample yesterday. This excel sheet was found in a mail flagged as “suspicious” by a security appliance. The recipient asked to release the mail from the quarantine because “it was sent from a known contact”. Before releasing such a mail from the quarantine, the process in place is to have a quick look at the file to ensure that it is safe to be released. The file is called ‘Info01.xls’ (SHA256:89e6e635c1101a6a89d3abbb427551fd9b0c1e9695d22fa44dd480bf6026c44c) is a VT score of 0/59. Yes, you read it correctly, it remains undetected by antivirus solutions… [Read more]


  1. What did you do to get the sheet to unhide in excel? It doesn’t show up in the unhide menu, nor in the VBA editor…

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.