MALICIOUS
240
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1105 Ingress Tool Transfer
The sample is an OLE Excel file containing a critical heuristic indicating an embedded PE executable. The document body is largely garbled and does not provide a clear lure, but the presence of the embedded executable strongly suggests a malicious intent to deliver a secondary payload. The heuristics related to PEB access and LoadLibrary/GetProcAddress APIs further support the execution of external code.
Heuristics 6
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
Disassembly
x86 disassembly · validity: code (0.984) — 3/3 branch targets land on an instruction boundary (100% coherence)000047B9 64a130000000 mov eax, dword ptr fs:[0x30] 000047BF 8b400c mov eax, dword ptr [eax + 0xc] 000047C2 8b701c mov esi, dword ptr [eax + 0x1c] 000047C5 ad lodsd eax, dword ptr [esi] 000047C6 8b6808 mov ebp, dword ptr [eax + 8] 000047C9 8bf7 mov esi, edi 000047CB 6a0d push 0xd 000047CD 59 pop ecx 000047CE e8df010000 call 0x49b2 000047D3 e2f9 loop 0x47ce 000047D5 8bee mov ebp, esi 000047D7 8b4530 mov eax, dword ptr [ebp + 0x30] 000047DA 894550 mov dword ptr [ebp + 0x50], eax 000047DD 81ec00040000 sub esp, 0x400 000047E3 8bf4 mov esi, esp 000047E5 83c604 add esi, 4 000047E8 33c0 xor eax, eax 000047EA 894530 mov dword ptr [ebp + 0x30], eax 000047ED 8b7d5c mov edi, dword ptr [ebp + 0x5c] 000047F0 83453004 add dword ptr [ebp + 0x30], 4 000047F4 6a00 push 0 000047F6 ff7530 push dword ptr [ebp + 0x30] 000047F9 ff552c call dword ptr [ebp + 0x2c] 000047FC 3bc7 cmp eax, edi 000047FE 75f0 jne 0x47f0 00004800 8bfe mov edi, esi 00004802 57 push edi 00004803 6800010000 push 0x100 00004808 ff5508 call dword ptr [ebp + 8] 0000480B 33c0 xor eax, eax 0000480D 40 inc eax 0000480E 803c0700 cmp byte ptr [edi + eax], 0 00004812 75f9 jne 0x480d 00004814 894560 mov dword ptr [ebp + 0x60], eax 00004817 c7 .byte 0xc7 00004818 04 .byte 0x04
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 206,336 bytes but its declared streams total only 123,700 bytes — 82,636 bytes (40%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x61 bytesDisassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'popal' is 60% of instructions — a sled or padding/filler run, not program logic).
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_0001ec00.exe |
embedded-pe | Office MZ+PE at offset 0x1EC00 | 80384 bytes |
SHA-256: d1aa35d94be203250412f04f828e1c292086db9a344777860405a3a255c21d72 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.