Office (OLE) malware analysis — malicious · 4437295e4489e75e

MALICIOUS

Office (OLE)

117.7 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel First seen: 2026-05-10

MD5: 5e0442c180c657da97db8b2d75997a27 SHA-1: 641b6d08f08967509301286e5e3847446e6d152f SHA-256: 4437295e4489e75eafe8b683cc383bf43b56f4268c0c5b1486e7173199e6074f

242 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is an Excel document that triggers a critical heuristic for CVE-2009-3129, an Excel FEATHEADER record overflow vulnerability. High severity heuristics for CreateProcess, VirtualAlloc, LoadLibrary, and GetProcAddress indicate the exploitation leads to the execution of additional code. The presence of VBA-related heuristics suggests a macro-based execution path, likely involving Visual Basic. The benign URLs extracted do not provide further clues about the payload.

Heuristics 7

CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129

Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 120,520 bytes but its declared streams total only 24,565 bytes — 95,955 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ocsp.verisign.com0 In document text (OLE body)
- http://ocsp.verisign.com01In document text (OLE body)
- https://www.verisign.com/rpaIn document text (OLE body)
- http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn document text (OLE body)
- https://www.verisign.com/rpa0In document text (OLE body)
- http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In document text (OLE body)
- https://www.verisign.com/cps0In document text (OLE body)
- http://logo.verisign.com/vslogo.gif0In document text (OLE body)
- http://crl.verisign.com/pca3.crl0In document text (OLE body)
- https://www.verisign.com/cps0*In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.

Office (OLE)

Malware Insights

Heuristics 7

Related samples 8