Office (OLE) / .XLS malware analysis — malicious · 0a2f25fbde1cf728

MALICIOUS

Office (OLE) / .XLS

112.1 KB

MD5: 1c896d3487225a8acada07fc28ebb952 SHA-1: 13eba0e7c1d53fc7f2cbaa604bc79aab9ca0d4e0 SHA-256: 0a2f25fbde1cf728d7f668ceb96546a337824545dbd26e1b1c1a7c75251d6a85

142 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1203 Exploitation for Client Execution

The presence of XOR-encoded strings and a reference to the CreateProcess API strongly indicates that this Office document is designed to execute a secondary payload. The large slack space in the OLE structure is also a common evasion technique. While no specific family is identified, the techniques suggest a downloader or dropper.

Heuristics 4

XOR-encoded strings (key 0x98) critical SC_XOR_ENCODED

Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0x98: 'wininet.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA', 'InternetOpenA', 'HttpOpenRequestA', 'HttpSendRequestA'
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 114,816 bytes but its declared streams total only 56,346 bytes — 58,470 bytes (51%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.microsoft.com
- https://www.verisign.com/rpa
- http://ocsp.verisign.com/ocsp/status0
- https://www.verisign.com/rpa0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.