Office (OLE) / .XLS malware analysis — malicious · 5729cd9acd5abd8d

MALICIOUS

Office (OLE) / .XLS

63.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: fc5e4283bec56cdf4adc6269a3c9e279 SHA-1: 0d9a4b3e7da7d0bb2c216ff2fe82f513f6fedb09 SHA-256: 5729cd9acd5abd8dff971153ecce0a4deee9334b7d9178da458ac64c820944cf

160 Risk Score

Malware Insights

MITRE ATT&CK

T1218 System Binary Proxy Execution T1059 Command and Scripting Interpreter

The presence of OLE_SLACK_ANOMALY and references to VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress APIs strongly suggest that this Excel file contains embedded malicious code, likely VBA macros. These APIs are commonly used by malware to allocate memory, modify its protection, load external libraries, and resolve function addresses, indicating an attempt to execute arbitrary code. The file is classified as malicious with a high risk score, but no specific family could be identified from the available heuristics.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 64,522 bytes but its declared streams total only 24,565 bytes — 39,957 bytes (62%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.