Office (OLE) / .XLS malware analysis — malicious · 0486e9c824dfff83

MALICIOUS

Office (OLE) / .XLS

313.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: d23296dd2569fd890f05cd04b5b98d39 SHA-1: 412c8948528a7fa65a456fb1c27968400f7e8e3d SHA-256: 0486e9c824dfff83f7a8f408f78a53fd6e2ccbb6f20ceef031fb9cbedcd02ca7

440 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file exhibits characteristics of a malicious OLE document, including a large slack space and an appended executable payload. Heuristics indicate the use of Windows API functions such as WinExec, ShellExecute, VirtualAlloc, and CreateRemoteThread, suggesting the execution of shellcode. The presence of XOR-encoded strings further points to obfuscation techniques commonly employed by malware.

Heuristics 11

Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
XOR-encoded strings (key 0x90) critical SC_XOR_ENCODED

Found 5 Windows library/API name(s) XOR-encoded with single-byte key 0x90: 'kernel32.dll', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'HttpOpenRequestA'
NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 321,472 bytes but its declared streams total only 21,308 bytes — 300,164 bytes (93%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.