Office (OLE) / .XLS malware analysis — malicious · 3dbcdea65f016d0f

MALICIOUS

Office (OLE) / .XLS

659.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel

MD5: 168cec805e54ef9b17adec56ec0559c3 SHA-1: 6a75ff72aca960761432a7e523144f4147f600f1 SHA-256: 3dbcdea65f016d0f6d0087c54970decb37b4d9189528eb8286dd2a58d7d38523

150 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The critical heuristic firing for CVE-2017-0199 indicates the file is designed to exploit a vulnerability in OLE to load remote content. The embedded URL points to a suspicious domain and appears to be a lure for a trial download, likely a pretext for delivering malware. The secondary embedded PDF also contains suspicious findings, suggesting a multi-stage attack. No VBA macros were found to be executable, but the primary exploit vector is clear.

Heuristics 5

OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199

Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED

Long run of 0x43 bytes
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1206 bytes
`stream_001_off0001d484.bin` `9599658cc9eae50662a589134de51ec670e648f453a28cffaa4d13a581396cbb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1D484	285576 bytes
`stream_018_off00077c98.bin` `cab0eabf04a5d34936562832ff53bf107c823929526a3b58826cc1b60b8c2bbc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x77C98	66548 bytes
`font_01_sfnt_off00073fc0.bin` `5e68e88c987c54e64a4d101ad3db57add9e4929aeec402e4fee53d1cd7aa537a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x73FC0	40548 bytes
`font_03_sfnt_off0007eec7.bin` `dcf6f0923ad448731206952ff57c4d2b3e8620fc6972598ab1bd23d28e62ab42`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7EEC7	56496 bytes
`font_04_sfnt_off000845f5.bin` `31710cdfd216f38fb46a851db560161e19419f08661279aff779873a436d680d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x845F5	5220 bytes
`polyglot_child_pdf_off00001600.pdf` `dd136c8885edf76b7b39972aea4aaf48fb2819611ecd02e4910047a0d44a0667`	polyglot-child-pdf	Secondary PDF body inside ole container at offset 0x1600	669184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.