Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 bbfc058deca3f8d5…

MALICIOUS

Office (OLE) / .XLS

511.2 KB Authoring application: Microsoft Excel
MD5: 699f58d472091346857e3970c9c2764e SHA-1: ee8d3ce2c529878f4d308ab64b828749261c4ec6 SHA-256: bbfc058deca3f8d52dc365e7be8ff448a6c7729632819a533d34daf0478ab2db
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information

The sample is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded content. A critical heuristic firing indicates XOR-encoded strings with a key of 0xDE, suggesting the macro code is likely obfuscated. While the VBA project contains no executable statements directly, the presence of the SC_STR_VIRTUALALLOC heuristic suggests the macro may attempt to allocate memory for malicious code execution. The overall pattern points to a macro-based downloader, though the exact payload and delivery mechanism are not fully discernible from the provided evidence.

Heuristics 4

  • XOR-encoded strings (key 0xDE) critical SC_XOR_ENCODED
    Found 5 Windows library/API name(s) XOR-encoded with single-byte key 0xDE: 'GetProcAddress', 'CreateProcessA', 'ExitProcess', 'CreateFileA', 'CreateFileW'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 523,499 bytes but its declared streams total only 240,528 bytes — 282,971 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
481031c20227961d1e7d207d0bb17c79a9001efbdb37ac509a4ff93acb047bf0		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 606 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.