Office (OLE) / .XLS malware analysis — malicious · 98c1791fcef0ea22

MALICIOUS

Office (OLE) / .XLS

117.7 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel First seen: 2026-05-10

MD5: 210eff888ab086aa0e58299fccc436fb SHA-1: 43591da0b223274c0d97c557c8f3a72b7415b3bc SHA-256: 98c1791fcef0ea22b47b7ffc6a416f35482c298050d94d4976f94010cb128c0e

242 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The critical heuristic firing for CVE-2009-3129 indicates exploitation of a known Excel vulnerability. High-severity heuristics for CreateProcess, VirtualAlloc, LoadLibrary, and GetProcAddress suggest the execution of malicious code. While no specific family is identified, the combination of exploit and API calls points to a downloader or dropper functionality.

Heuristics 7

CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129

Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 120,520 bytes but its declared streams total only 24,565 bytes — 95,955 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ocsp.verisign.com0 In document text (OLE body)
- http://ocsp.verisign.com01In document text (OLE body)
- https://www.verisign.com/rpaIn document text (OLE body)
- http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn document text (OLE body)
- https://www.verisign.com/rpa0In document text (OLE body)
- http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In document text (OLE body)
- https://www.verisign.com/cps0In document text (OLE body)
- http://logo.verisign.com/vslogo.gif0In document text (OLE body)
- http://crl.verisign.com/pca3.crl0In document text (OLE body)
- https://www.verisign.com/cps0*In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.

Office (OLE) / .XLS

Malware Insights

Heuristics 7

Related samples 8