Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b97a89b9b32c5373…

MALICIOUS

Office (OLE)

54.5 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 3373bf21991ae88b52812e7c901c24f4 SHA-1: ea06d924b62619b37ef2051596675fb17a16a441 SHA-256: b97a89b9b32c53738d070e63b6f6fa737cb7f5efc04f1e507aa00316d863785b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is an OLE document with suspicious static findings, including a large unaccounted-for region and an OLE header with no readable streams. These anomalies suggest the file may be intentionally obfuscated to hide malicious content, likely an embedded exploit targeting Microsoft Excel. No specific IOCs were extracted, and the document body contained only garbled text.

Heuristics 3

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 26,240 bytes but its declared streams total only 0 bytes — 26,240 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00007380.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x7380 26240 bytes
SHA-256: 71aa8374b4ac8cd646d3e48e98d2526c01f1551d7d39d34a1cbbf0d5e5b43b2d

Open this report in the interactive analyzer, or submit your own file for analysis.