Office (OLE) / .XLS malware analysis — malicious · 994ed95946d1ee3c

MALICIOUS

Office (OLE) / .XLS

319.2 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: b30b9a66f3173ba42aac5a9d66a2b059 SHA-1: 12932cfd9f3a0049fc576495a74ae0406135ab7b SHA-256: 994ed95946d1ee3c9ae8aff9dfe086719c84b251c44faaebd7b67d9d96826033

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1566.002 Spearphishing Attachment

The file is an OLE Excel spreadsheet containing both XLM and VBA macros. The Workbook_Open VBA macro is present and likely executes embedded code. Heuristics indicate an appended payload and obfuscated VBA strings, suggesting the file is designed to download and execute additional malicious content. The presence of both macro types and appended data points to a downloader or droppper functionality.

Heuristics 6

OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 326,865 bytes but its declared streams total only 184,311 bytes — 142,554 bytes (44%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `62f283656519ff934c0a6c7d03e7efd9975c5150433831835d7133700532fbeb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.