Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a95dbcd44220e9b0…

MALICIOUS

Office (OLE)

52.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 3865a66d328f1c334e530f598d52be5a SHA-1: 5ed62f2333a8c58a54555d1d673795c45aa03fe5 SHA-256: a95dbcd44220e9b0fed6d4ba0b8fef1475fd773488d858c7478edf3ee4b871cb
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The sample is a malicious Excel OLE document. The presence of a 'x86 GetPC stub' heuristic firing suggests the potential for code execution or obfuscation within the document's structure. The large 'slack' space in the OLE document is also anomalous and can be used to hide malicious content. Without further script or body content, the exact attack vector is unclear, but it is likely designed to exploit a vulnerability or deliver a secondary payload.

Heuristics 2

  • x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EDI)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 54,154 bytes but its declared streams total only 24,565 bytes — 29,589 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.