I downloaded an Excel (.xlsx) file from the internet.
Then I tried to open it by double-clicking on it. But it suddenly crashed.
Could this mean it could've contained a virus or malware?
-
3Double clicking is opening. It could have executed a payload and then crashed Excel.– ThoriumBRCommented Feb 20 at 16:47
Add a comment
|
1 Answer
Yes, it could.
Lots of malware use a buffer overflow to execute its payload: they hijack the normal program execution to execute something else. This can end up making the program crash, because the malware have no interest in doing a clean job, or they don't have enough space for doing a clean exit.
So it's possible to have malware executed even if Excel crashed. It could have executed its payload and ignored the proper clean exit routine, or it could have failed and just crashed Excel.
How to tell?
- You could run Excel on a debugger, load the file, and trace the execution.
- You could submit the file to VirusTotal (thanks schroeder) and see if they detect something.
- Or you could just assume you got infected, reinstall the system from scratch and restore from a clean backup.
-
1That said, what are the odds that OP actually has an Excel file containing a working exploit for their version of Excel (hopefully up to date)? Such an exploit could be worth up to $100,000 according to Zerodium, and probably costs even more to purchase. This is feasible if OP is targeted by e.g. a nation state. However, if OP is an average person, Occam's Razor suggests that it is more likely just a bug in Excel. Commented Feb 21 at 1:40
-
1
-
So, to answer the question, it is possible that a xlsx file could infect a computer even if it "crashes". However, the likelihood for an up-to-date version of Excel (at this time) being infected this way is low. The more likely explanation is a damaged file.– schroeder ♦Commented Mar 8 at 10:52