Office (OLE) / .XLS malware analysis — malicious · 601c845abb050222

MALICIOUS

Office (OLE) / .XLS

123.5 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 2655382f934be981953970eddc644f28 SHA-1: e8a90a0efc8f4ffbf8161086127982e31a0a2f05 SHA-256: 601c845abb050222297d0aa76a01f121cdad6925f0a50d159a1828363f6d80e9

260 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The critical heuristic firing for CVE-2009-3129 indicates exploitation of a Microsoft Excel vulnerability. High-severity heuristics for CreateProcess, LoadLibrary, and GetProcAddress APIs suggest the execution of malicious code, likely a downloader. The OLE Slack Anomaly and Appended Payload heuristics further support the presence of an embedded or appended executable payload. The lack of document body text or scripts means the exact nature of the payload cannot be determined, but the exploitation pattern is clear.

Heuristics 6

CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129

Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 126,464 bytes but its declared streams total only 24,565 bytes — 101,899 bytes (81%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.