Xls.Dropper.Agent — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 939414c113f94ccf…

MALICIOUS

Office (OLE) / .XLS

60.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 0700bffe83561c1e2a5156d89de68f6d SHA-1: 67703670655ebaeca5d6f27d42200dcc9ff872c8 SHA-256: 939414c113f94ccfa289dcebac2dcd68f9c5dd16e62b3ad504f27c67306e1099
140 Risk Score

Malware Insights

Xls.Dropper.Agent · confidence 95%

The critical ClamAV detection of 'Xls.Dropper.Agent-7622825-0' strongly indicates this Excel file is a dropper. The 'SC_GETPC_CALL' heuristic suggests the presence of obfuscated code, common in droppers to hide their malicious intent. The large slack space in the OLE structure is also a common characteristic of packed or obfuscated malicious documents.

Heuristics 3

  • ClamAV: Xls.Dropper.Agent-7622825-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7622825-0
  • x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EDI)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 62,346 bytes but its declared streams total only 24,565 bytes — 37,781 bytes (61%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.