Office (OLE) / .XLS malware analysis — malicious · b0995e558cfe8b45

MALICIOUS

Office (OLE) / .XLS

243.3 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: 7cb3f031f797371ff5670b67c98cd478 SHA-1: c7f2ea31bf0ae64b62bf4bb1608eb44526864dd6 SHA-256: b0995e558cfe8b45bbca9294fe621289c56f6e029f76560be87893aca8560250

220 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate or Reverse Engineer

The file is an Excel spreadsheet containing both VBA and XLM macros. The Workbook_Open VBA macro triggers a function that appears to implement a game-like interface. The presence of XOR-encoded strings and an appended executable payload suggests that the macro functionality is a lure or a loader for more malicious activity. The XLM macros are truncated, but their presence alongside VBA macros and an appended payload indicates a multi-stage attack. The primary intent appears to be obfuscating the execution of an appended payload.

Heuristics 6

XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED

Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualProtect'
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `4c5fca5cd2dca389f1f56567bb14084df23340def0a9918060fc4a002f992750`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.