Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9add631fd9c4812c…

MALICIOUS

Office (OLE)

413.5 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel
MD5: 53280e9a0d240325d83634dc03bb302d SHA-1: 59fa883ad977d29f9ad782d3050aca74e9c6c52c SHA-256: 9add631fd9c4812cb6334c6cf3a300c8405bdd16659578b0f535209c5b422663
100 Risk Score

Malware Insights

The sample is an Excel file with a significant amount of slack space (96%), indicating it may be used to hide malicious code or a loader. A critical heuristic identified XOR-encoded strings with a key of 0xFC, commonly used to obfuscate malicious payloads. No document body or scripts were extracted, limiting further analysis of the exact payload or delivery mechanism. The confidence is moderate due to the lack of explicit script or body content.

Heuristics 2

  • XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED
    Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'RegOpenKeyExA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 423,424 bytes but its declared streams total only 15,628 bytes — 407,796 bytes (96%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.