Office (OLE) malware analysis — malicious · 547a50864d61bcaf

MALICIOUS

Office (OLE)

281.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14

MD5: fee3e107081f06493f964714a9c8e100 SHA-1: 66dd9b84fc3ea944e4f25eb89e36df6301816290 SHA-256: 547a50864d61bcafd64b7de08e87b1c5d311c4d932ed56c5ea6de667fc5c4ae4

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as a malicious Excel 5 document by the OLE_XLS5_LAROUX_MACRO_VIRUS heuristic, indicating the presence of a macro virus. The document contains embedded Office content with suspicious static findings and a large amount of slack space, suggesting an attempt to evade static analysis. No specific IOCs like URLs or hashes were extracted, but the presence of the macro virus is a critical finding.

Heuristics 4

Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS

Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 275,334 bytes but its declared streams total only 0 bytes — 275,334 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off0000327a.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x327A	275334 bytes
SHA-256: `3cfc88cdd598ecfd00646476e6acfe3f0649aabe89b6c42ad8af65d2fb88118c`

Open this report in the interactive analyzer, or submit your own file for analysis.