Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 033e5b1fa3a1bc1c…

MALICIOUS

Office (OLE)

52.5 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 17fd4ab70900010f575406e9bef25c5a SHA-1: ea3f4232415797b300d78539de63364732dbcb91 SHA-256: 033e5b1fa3a1bc1c4a49d6122d26930a12bafae5673ac3db023a46a7752c241e
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is a malicious Microsoft Excel document that exploits CVE-2009-3129, a record overflow vulnerability. This exploit allows for arbitrary code execution on the victim's machine. No document body or scripts were extracted, but the critical heuristic firing strongly indicates a vulnerability exploitation.

Heuristics 2

  • CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129
    Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 53,783 bytes but its declared streams total only 24,565 bytes — 29,218 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.