Office (OLE) / .XLS malware analysis — malicious · 80509edd25c1f016

MALICIOUS

Office (OLE) / .XLS

117.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: c1b575fb457ce306d385f7641b68d898 SHA-1: 6964c7ffa30e9db41e6ad103702cc6082be7fcb8 SHA-256: 80509edd25c1f016c95f3f3d739d9a18ca85bf84b44e9fd421164c2522fbb7d5

140 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The file is an Excel spreadsheet exhibiting a high degree of slack space, a common characteristic of packed or obfuscated malicious documents. Heuristic analysis detected references to VirtualAlloc, LoadLibrary, and GetProcAddress APIs, which are frequently used by malware to dynamically load and execute code. While no document body or scripts were extracted, these API calls strongly suggest the file's intent is to download and execute a second-stage payload.

Heuristics 4

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 120,733 bytes but its declared streams total only 24,565 bytes — 96,168 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.