Office (OLE) / .XLS malware analysis — malicious · b61aa2f1079bff7a

MALICIOUS

Office (OLE) / .XLS

875.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2026-03-11

MD5: 4d67a4dcc77d2bde6dde5905962b5230 SHA-1: 5e3a55eaf03b7be4f2c9127eadbd7fd4a98004af SHA-256: b61aa2f1079bff7a5a7d3ad6da5c914309319b050b1a88b9a1c702e2d26026c4

88 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution

The presence of an Equation Editor OLE object (OLE_EQUATION_EDITOR) strongly suggests exploitation of a known vulnerability within this component. The GetPC stub firing further indicates executable code is present. While no VBA macros were found to contain executable statements, the OLE object itself is the primary indicator of compromise, likely leading to arbitrary code execution. The file is an Excel spreadsheet, and the exploit targets the Equation Editor, a common vector for initial access.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
x86 GetPC stub (CALL $+5; POP EBX) high SC_GETPC_CALL

x86 GetPC stub (CALL $+5; POP EBX)
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1206 bytes
`ole10native_00.bin` `dbaeb00d2d19b951f0c2991cecf70db9956a9d231ca322c565d7285fbb618120`	ole-package	OLE Ole10Native stream: MBD011788E5/OlE10NATiVE	1920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.