Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8aa35f9b3b6b45fe…

MALICIOUS

Office (OLE) / .XLS

60.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: decd743124efe80d8a2d9eeb09a7ccd5 SHA-1: 128d6ab844b2d2312136897c22ea5bd1a7a6bc0d SHA-256: 8aa35f9b3b6b45fe317023e6dfa2c75756c9ab849be566ae8b0a3738f16a3883
80 Risk Score

Malware Insights

The sample is an Excel spreadsheet exhibiting an OLE slack anomaly and an x86 GetPC stub, both high-severity heuristic firings. These indicators suggest the file is likely a malicious document, potentially designed to execute arbitrary code or deliver a secondary payload, though no specific delivery mechanism or target is evident from the provided data. No scripts were extracted, and the document body is empty.

Heuristics 2

  • x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EDI)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 62,346 bytes but its declared streams total only 24,565 bytes — 37,781 bytes (61%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.