Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5c55170401dc0e75…

MALICIOUS

Office (OLE)

126.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 62353084f98468b0fa698c98ddbb56e2 SHA-1: 5f641d70def0f2dafd568131ff9a368c39a369ad SHA-256: 5c55170401dc0e7570e545db4564a2530c540593e3c02ebe185e3b362108084b
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as a malicious Excel 5 macro-virus (Laroux/Larou-CV) due to the presence of specific marker clusters and anomalous OLE structure. The embedded document exhibits suspicious static findings, including large slack space and unreadable streams, indicating potential obfuscation or corruption designed to evade analysis. The presence of VBA macro markers strongly suggests the execution of Visual Basic code for malicious purposes.

Heuristics 4

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 111,548 bytes but its declared streams total only 0 bytes — 111,548 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00004644.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x4644 111548 bytes
SHA-256: a94783e91d0ed68f0a0ea77a43ba9789c4ecde6410a4c0b57fbab172b8f5d9ed

Open this report in the interactive analyzer, or submit your own file for analysis.