Office (OLE) malware analysis — malicious · 0982f60e9b377ae8

MALICIOUS

Office (OLE)

51.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 0740379f753f6320a1a0d43c7965db0d SHA-1: 0804f9f0e1e99654040ffc83e2204b2f530b2828 SHA-256: 0982f60e9b377ae8d9573d9a8144b2752e5878b673c1e979f906b53197942fa0

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is an Office document containing VBA macros, identified by the OLE_VBA_MACROS heuristic. The document body presents a fabricated performance review, a common lure for social engineering. The VBA macro code, though truncated, contains suspicious elements like base64 encoding and API calls for file operations, suggesting it's designed to download and execute a second-stage payload. The presence of heap spray and NOP sled heuristics further indicates potential exploitation or shellcode execution.

Heuristics 4

Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x41 (A) bytes found
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED

Long run of 0x41 bytes
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ca3d3bd3189e3836172b4284dea38d7411e79d18899da15970292089b9d8e8dd`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7454 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 9 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.