Office (OLE) malware analysis — malicious · 7761879d49c05940

MALICIOUS

Office (OLE)

393.2 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: fa6a3de6e63c7e229cc1a640e566e563 SHA-1: f646660766514957c79b18717093083a49e28129 SHA-256: 7761879d49c059401e7869ac81ae78686662255f57b91b26c399f80b6c00f0fb

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing both VBA and Excel 4.0 macros, with a Workbook_Open subroutine present. The macros appear to set up a game-like interface, which is a common tactic to distract users while the malicious code executes. The presence of an appended payload and XOR-encoded strings suggests the file is designed to download and execute further malicious content.

Heuristics 6

XOR-encoded strings (key 0x59) critical SC_XOR_ENCODED

Found 7 Windows library/API name(s) XOR-encoded with single-byte key 0x59: 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateProcessA', 'ExitProcess', 'CreateFileA', 'CreateThread'
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 402,620 bytes but its declared streams total only 184,311 bytes — 218,309 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `e5d4719ac0a05e5da147dc31ed80333563c2b4023b91e280370d0f92ffb1dbc4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27327 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.