Office (OLE) / .XLS malware analysis — malicious · 916e88532a16830e

MALICIOUS

Office (OLE) / .XLS

101.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: e77dff57f1d66783da511ead55a4ef54 SHA-1: 9a0627efd1f0b0b8e02121ad865a667f4dcaef04 SHA-256: 916e88532a16830ea80b77cd05e7d0aa6f835b0ccf55ad01589c49826a2d562f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The sample is an OLE Excel file with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. Heuristics indicate the presence of references to WinExec and CreateProcess APIs, suggesting the file's intent is to execute arbitrary code. The lack of document body text or scripts means the exact payload and delivery mechanism cannot be determined, but the API calls strongly suggest a downloader or direct execution of a malicious binary.

Heuristics 3

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 103,407 bytes but its declared streams total only 24,565 bytes — 78,842 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.