Office (OLE) malware analysis — malicious · c8a0abd239705dc5

MALICIOUS

Office (OLE)

237.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 499631b4bcacac498fced7c59769012d SHA-1: 9d4ae02aade1143502741ade40187fa43c21ce56 SHA-256: c8a0abd239705dc58ed25448993bd2d7720838e46575fdec6f0e3e0b07701086

140 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The sample is an Excel document exhibiting a high degree of slack space, a common characteristic of packed or obfuscated malware. Heuristic firings indicate the presence of APIs typically used for dynamic code loading and execution, specifically VirtualAlloc, LoadLibrary, and GetProcAddress. These findings suggest the document contains embedded code intended to allocate memory, load additional modules, and resolve function addresses, likely to download and execute a secondary payload. No document body text or scripts were extracted, limiting further analysis of the specific lure or payload mechanism.

Heuristics 4

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 243,613 bytes but its declared streams total only 24,565 bytes — 219,048 bytes (90%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.