MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The sample is an OLE file with a significant amount of slack space, indicating potential obfuscation or padding. Crucially, it contains an Excel 4.0 (XLM) macro, identified by the 'OLE_XLM_AUTOOPEN' heuristic. This type of macro is known for its ability to execute arbitrary code, often used as a loader for further malicious activity. No specific URLs or scripts were extracted, limiting the ability to determine the exact payload or family.
Heuristics 3
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 56,328 bytes but its declared streams total only 0 bytes — 56,328 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMSThe file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Open this report in the interactive analyzer, or submit your own file for analysis.