Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 27a1b35960ff803f…

MALICIOUS

Office (OLE)

807.5 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel First seen: 2026-05-11
MD5: 9fa268f469f05abc7381009f2f6a6758 SHA-1: c73e7d2b222628e74c175024ea0bf756f0b6a3bd SHA-256: 27a1b35960ff803f8a78cf244939fb0abd9056e496cf52b3b21378fc9cd49863
100 Risk Score

Malware Insights

The OLE document exhibits a significant slack space anomaly, suggesting it may contain hidden or obfuscated content. Although VBA macros could not be extracted due to an unsupported format, the document body presents itself as a series of application forms for various permits. This structure is commonly used in phishing campaigns to trick users into submitting sensitive personal information.

Heuristics 2

  • Excel Index Array exploit — CVE-2008-3005 critical CVE likely CVE_2008_3005
    Legacy Excel workbook has the CVE-2008-3005 exploit shape: a compact BIFF8 FORMAT-index cluster paired with a normal XF table and a large unallocated OLE slack region used to stage the payload. The FORMAT pattern alone is not sufficient, so the rule requires the OLE slack payload-hiding context to keep false positives low.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 826,880 bytes but its declared streams total only 21,308 bytes — 805,572 bytes (97%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.