Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 24940f5b1be20c0d…

MALICIOUS

Office (OLE)

126.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2015-09-18
MD5: 07c6e0ec06dc7a63921057dd736d4380 SHA-1: 7e70788254feecd8d322bc858311ee3441521d2f SHA-256: 24940f5b1be20c0d3f49933ecfe20a63bb2f3e39a1a95f0c99f80209e38b414b
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as a malicious Excel 5 macro-virus (Laroux/Larou-CV) due to the presence of specific marker clusters and anomalous OLE structure. The embedded document exhibits suspicious static findings, including large slack space and unreadable streams, indicating potential obfuscation or corruption designed to evade analysis. The presence of VBA macro markers strongly suggests the execution of Visual Basic code for malicious purposes.

Heuristics 4

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 111,549 bytes but its declared streams total only 0 bytes — 111,549 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00004644.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x4644 111549 bytes
SHA-256: 0c724d175835ab362c0158ce5f4e2607eca87758414c076dd38d4b739eaf4e2d

Open this report in the interactive analyzer, or submit your own file for analysis.