Office (OLE) / .XLS malware analysis — malicious · 088ca4283ee859b3

MALICIOUS

Office (OLE) / .XLS

158.0 KB

MD5: 3d74b6b4140ffd8fcfbec17dcd0c7a9e SHA-1: 9365f6c4cb9e4b07b8aaea8d26b0e9d8645e134a SHA-256: 088ca4283ee859b32c1d92a096d3ca262d80aac1fdd87d3762b29b912040f104

122 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The presence of SC_STR_LOADLIBRARY and SC_STR_GETPROCADDRESS heuristics indicates the sample is attempting to dynamically load and execute code, a common technique for malware droppers. The large slack space in the OLE structure suggests obfuscation or embedded malicious content. While no specific family is identified, the techniques used point towards a malicious executable loader.

Heuristics 4

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 161,792 bytes but its declared streams total only 56,346 bytes — 105,446 bytes (65%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.microsoft.com
- https://www.verisign.com/rpa
- http://ocsp.verisign.com/ocsp/status0
- https://www.verisign.com/rpa0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.