Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 927071c0421eac39…

MALICIOUS

Office (OLE) / .XLS

121.4 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: a4c651dc7f684123351e14d556fbce74 SHA-1: fec44e8b4c358099485bab7d4961b4ed80fbbd4e SHA-256: 927071c0421eac398d92b53e604d552c0a939cb3314743e2fc5b83cbf23a3003
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1204.002 Malicious File: User Execution

The sample is an Excel spreadsheet that triggers the CVE-2009-3129 vulnerability. This vulnerability allows for arbitrary code execution when the file is opened. The presence of a GetPC stub further indicates an attempt to execute shellcode. No specific family could be identified, and no further IOCs were extracted.

Heuristics 3

  • CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129
    Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=22, isf=4, cbHdrData=4). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
  • x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EDI)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 124,298 bytes but its declared streams total only 24,565 bytes — 99,733 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).