Xls.Dropper.Agent-7079703-0 Office (OLE) malware analysis — malicious · cc5cd3ad4d8ae972

MALICIOUS

Office (OLE)

956.9 KB Created: 2003-07-13 10:04:24 Authoring application: Microsoft Excel First seen: 2019-11-20

MD5: af10e8f486edd2d867b9e34d9f82f916 SHA-1: 0a3b67aa90777642962944e00933f631aebdbf1f SHA-256: cc5cd3ad4d8ae972aec04e353b23da7eafc4f104d4c90a3c93114e57fdcddff7

602 Risk Score

Malware Insights

Xls.Dropper.Agent-7079703-0 · confidence 95%

MITRE ATT&CK

T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel document identified by ClamAV as 'Xls.Dropper.Agent-7079703-0'. It contains multiple embedded PE executables and OLE objects, indicating a dropper functionality. Heuristics for CreateProcess, ShellExecute, and URLDownloadToFile suggest the file's intent is to download and execute additional malicious content. The presence of embedded executables strongly supports this dropper behavior.

Heuristics 14

ClamAV: Xls.Dropper.Agent-7006647-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.Agent-7006647-0
Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 979,871 bytes but its declared streams total only 12,288 bytes — 967,583 bytes (99%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ocsp.verisign.com0 In document text (OLE body)
- http://crl.verisign.com/ThawteTimestampingCA.crl0In document text (OLE body)
- http://crl.verisign.com/tss-ca.crl0In document text (OLE body)
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn document text (OLE body)
- http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In document text (OLE body)
- http://office.microsoft.comIn document text (OLE body)

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000660a.exe`	embedded-pe	Office MZ+PE at offset 0x660A	953749 bytes
SHA-256: `2143527f6698077b9482f81d745a2bbad662ada3699d6a6ceccb6a6211172116`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln
`embedded_office_off00003605.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x3605	966042 bytes
SHA-256: `40d3de0196ed2b3e5d0cfaf6d7417d7bc67a1b6390636a90be5037ebc99fcff9`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln
`embedded_office_off00006480.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x6480	954143 bytes
SHA-256: `830a02cb3287196152a281699905d9b024f9edd1aba8a873227e6a38adb291ef`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln
`embedded_office_0000660a_1.exe`	embedded-pe	Office MZ+PE at offset 0x660A	623067 bytes
SHA-256: `79038ad7cc1f00f2e9ff1cb0c73704f13123689ff07ad6f3c2d416095aaa5e76`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln
`embedded_office_off00050bba.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x50BBA	649189 bytes
SHA-256: `709a323a48b8942e948870291cf63331ff3c0f84400ce3b4a19812d5e038d3fc`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln
`embedded_office_off000541bf.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x541BF	635360 bytes
SHA-256: `cc5d14578e4f5b191dd3a6c7838f71057ac5e9859e348a86b3fe14f9ba870372`
Detection ClamAV: Win.Trojan.Agent-6943819-1 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdln

Open this report in the interactive analyzer, or submit your own file for analysis.