Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 d196c60641b39052…

MALICIOUS

Office (OLE) / .XLS

230.5 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel
MD5: 510ad9025797437cfafe4ccd874da033 SHA-1: 74e2c54d159cbae9b844c7d86aaeefec33c03045 SHA-256: d196c60641b39052ea55ebe32231228aeeb059fdbe754bd96b37865edd27d209
100 Risk Score

Malware Insights

The sample is a malicious Excel spreadsheet exhibiting a critical heuristic for XOR-encoded strings with a key of 0xFC. Additionally, it shows a high heuristic for OLE slack space anomaly, indicating potential obfuscation or embedded malicious content. No document body or scripts were extracted, limiting further analysis of the specific payload or delivery mechanism. The confidence is moderate due to the lack of explicit script or body content.

Heuristics 2

  • XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED
    Found 3 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'LoadLibraryA', 'GetProcAddress', 'RegOpenKeyExA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 236,080 bytes but its declared streams total only 15,628 bytes — 220,452 bytes (93%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.