Office (OLE) malware analysis — malicious · 0c750cfeccdaca93

MALICIOUS

Office (OLE)

38.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14

MD5: 5dff39577f5aa9af8cbf1c9c0e23cd42 SHA-1: efe90d19c291ed47c02409b0d8f7f32535970cdf SHA-256: 0c750cfeccdaca93bedb7d19473167dca5dfa34f2d063d8ec1e11cbcf5f8c6f3

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Edure-1. Heuristics indicate suspicious OLE structure, including slack space anomalies and unreadable streams, suggesting an attempt to obfuscate content. The embedded OLE object further supports the likelihood of a malicious payload delivery mechanism, commonly associated with spearphishing attachments.

Heuristics 4

ClamAV: Xls.Trojan.Edure-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Trojan.Edure-1
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 26,735 bytes but its declared streams total only 0 bytes — 26,735 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00003191.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x3191	26735 bytes
SHA-256: `e6b361ab610542efff99417cc732795ad29a3d12026eecbcc6cd4a694e4b93ac`

Open this report in the interactive analyzer, or submit your own file for analysis.