Office (OLE) / .XLS malware analysis — malicious · 09dea6e759270485

MALICIOUS

Office (OLE) / .XLS

100.1 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 8ca70aa1ce3026f1798374eefdf8f8ea SHA-1: 735e59dd519cac266f03be9d03bfa2478ade7730 SHA-256: 09dea6e7592704851230de2e04276a436ec8e610195ec15e9223c022bb2926bc

260 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is an OLE document with a significant appended payload and references to Windows API calls for process creation and execution (CreateProcess, ShellExecute, LoadLibrary, GetProcAddress). This indicates the file is designed to drop and execute a secondary malicious payload. The document body content appears benign, suggesting the malicious functionality is entirely within the appended payload.

Heuristics 7

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 102,456 bytes but its declared streams total only 21,308 bytes — 81,148 bytes (79%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.