Malicious Office (OLE) / .EXE — malware analysis report

Static analysis result for SHA-256 5ee85d60edd50bce…

MALICIOUS

Office (OLE) / .EXE

32.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel
MD5: 80cdbef3f3e28cdb1b74eea82753487e SHA-1: 0e241b77a9b00bc6e04fa8e89cba545930bb7228 SHA-256: 5ee85d60edd50bceccfab86bb1e8404f386810ed629af2cb905fc95453a6ca38
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an OLE executable with a high risk score, containing an embedded Office document flagged for suspicious static findings including empty streams and directory cycles. This suggests the embedded document is malformed or intentionally obfuscated to evade detection, likely serving as a lure or exploit carrier. The presence of an embedded Office document within an executable points towards a multi-stage attack, potentially initiated via spearphishing.

Heuristics 2

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00006ef6.ole
863cf973d7db8977fdc74766496d649f6846de9130aa9240f3805ea46b844194		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x6EF6 4874 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.