Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 2deefdfd7ba95323…

MALICIOUS

Office (OLE) / .XLS

123.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 0de144967fbee04d958ffe660c77d07f SHA-1: 60f15ee1bf60aa17371f8ffaef8650d6f8b7c5f3 SHA-256: 2deefdfd7ba953231592ef63e8e20eacd517fef02408573f60bdae9eb13b6b31
82 Risk Score

Malware Insights

Static analysis identified significant slack space and an appended executable payload within the OLE file structure, indicating a malicious intent to conceal or deliver secondary malicious content. The file type is an Excel spreadsheet, but VBA macros could not be extracted due to an unsupported format, suggesting potential obfuscation or legacy structure. The exact nature of the payload and its delivery mechanism remain unclear due to the inability to parse VBA.

Heuristics 3

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 125,952 bytes but its declared streams total only 24,565 bytes — 101,387 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.

Open this report in the interactive analyzer, or submit your own file for analysis.