Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 5f4346a95e56b013…

MALICIOUS

Office (OLE) / .XLS

86.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 4edeec8da718550798d68bbaab4b8139 SHA-1: a2511c455395d7802b3d8ead485afa13e4815ca4 SHA-256: 5f4346a95e56b013a60c266ede0dabc3f5f3f192c2933ba2f080a63a13ea8fdb
280 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1071.001 Web Protocols

The file is an OLE document exhibiting significant slack space and appended executable content, indicating a likely attempt to hide a malicious payload. Heuristics firing for WinExec, CreateProcess, ShellExecute, LoadLibrary, and GetProcAddress suggest the sample is designed to execute code. The appended payload and API calls point towards a downloader or dropper functionality, though no specific family is identifiable.

Heuristics 7

  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 88,096 bytes but its declared streams total only 21,308 bytes — 66,788 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.