Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 abb8317ad6122721…

MALICIOUS

Office (OLE)

76.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: ec2a7666972bf0ba3dce0049c1dd8e05 SHA-1: 4d061219f6c7e859eb0790f72efdc99bc07939d5 SHA-256: abb8317ad6122721a6e74c5071f5beadde2956d964fd7892d26df8df6e485f98
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1027 Obfuscated Files or Information T1105 Ingress Tool Transfer

The sample exhibits OLE slack space anomalies and references to WinExec, LoadLibrary, and GetProcAddress APIs, indicating it likely attempts to execute arbitrary code. The presence of XOR-encoded strings with a key of 0x03 further suggests obfuscation of malicious content. Without a document body or scripts, the exact payload and delivery mechanism remain unclear, but the API calls point towards dynamic code loading and execution.

Heuristics 5

  • XOR-encoded strings (key 0x03) critical SC_XOR_ENCODED
    Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0x03: 'VirtualAlloc', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualProtect', 'VirtualProtectEx', 'CreateProcessA', 'WriteProcessMemory', 'ReadProcessMemory'
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 77,824 bytes but its declared streams total only 24,565 bytes — 53,259 bytes (68%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.