Malicious Office (OLE) / .XLS — malware analysis report

Heuristics 3

• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
  The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
• Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
  The Analyzer could not extract VBA macros: the document may be legacy, encrypted or malformed.

Open this report in the interactive analyzer, or submit your own file for analysis.