Office (OLE) / .XLS malware analysis — malicious · 2a813327275c37b0

MALICIOUS

Office (OLE) / .XLS

115.5 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel

MD5: a16e9682c82638070a85cdacb97b4e33 SHA-1: 16d0975fac5b4d4d72e95392e97103eae70923e8 SHA-256: 2a813327275c37b0fde26346f054b48b8e5595641ceee109595902ec5b4a49cf

128 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file is an Excel spreadsheet containing VBA macros. Heuristics indicate the use of LoadLibrary and GetProcAddress APIs, suggesting dynamic code loading. Although the VBA project itself contains no executable statements, the presence of these API calls and the OLE slack anomaly point towards a malicious intent, likely to download and execute a second-stage payload. The embedded URL, while marked as benign, is present in the document.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 118,272 bytes but its declared streams total only 42,689 bytes — 75,583 bytes (64%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://investor.msn.com/external/excel/quotes.asp?SYMBOL=[

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `73fe284b1e885bd0405ecb421b1224021163ce4aa3bca30e5a2deb64f9916b3c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.