Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8aa3e86aaa1d1981…

MALICIOUS

Office (OLE) / .XLS

159.9 KB Created: 2006-09-13 11:21:51 Authoring application: Microsoft Excel
MD5: 4f1a37175842e9322bd32079f7eeca0f SHA-1: 73cdf9c99065616914bef8ab126c7a0cb45414aa SHA-256: 8aa3e86aaa1d1981ba4f93436a9c655de0af32d64a3c38d70c60b2b73d5eebf1
108 Risk Score

Malware Insights

MITRE ATT&CK
T1559 Component Object Model Hijacking

The critical heuristic firing for an embedded SWF file within an OLE document strongly suggests an attempt to leverage Flash Player vulnerabilities. While the VBA macros themselves contain no executable statements, the presence of the SWF is the primary indicator of malicious intent. The embedded URL, though confirmed benign, was present in the document.

Heuristics 4

  • Embedded Adobe Flash (SWF) in OLE document critical OFFICE_EMBEDDED_SWF
    Document contains an embedded Adobe Flash (SWF) object. Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 163,772 bytes but its declared streams total only 83,289 bytes — 80,483 bytes (49%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adobe.com/AS3/2006/builtin

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
56845bb35fdf791b2d2b0ce90d464da9f81eef6f5c9562346451e8a85cc26aca		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 987 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.