Win.Trojan.Agent-30163 — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 616b561b49258346…

MALICIOUS

Office (OLE) / .XLS

70.5 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: d4b98bda9c3ae0810a61f95863f4f81e SHA-1: f0794e5b941b70a22fef5e200806a8b71606b325 SHA-256: 616b561b49258346ead431e34fb1925e2dbc11fb4620083efae92d7ed8e5333c
280 Risk Score

Malware Insights

Win.Trojan.Agent-30163 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV as Win.Trojan.Agent-30163. Static analysis reveals critical heuristics related to CVE-2009-3129, an Excel FEATHEADER record overflow vulnerability, indicating exploitation for client execution. High-severity heuristics also point to the use of CreateProcess, LoadLibrary, and GetProcAddress APIs, common in malware for loading and executing additional stages.

Heuristics 6

  • CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129
    Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
  • ClamAV: Win.Trojan.Agent-30163 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-30163
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 72,192 bytes but its declared streams total only 24,565 bytes — 47,627 bytes (66%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.