Office (OLE) / .XLS malware analysis — malicious · d392b6ebcbd2c0c8

MALICIOUS

Office (OLE) / .XLS

114.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 4fb8763eabbba591536f76421890012d SHA-1: ac463679743b6ff2380b64b09872689cd601998b SHA-256: d392b6ebcbd2c0c8d88a743d4ce1b5c72114d1b10f023b4defc5fa5a6fe697d8

140 Risk Score

Malware Insights

MITRE ATT&CK

T1218 System Binary Proxy Execution

The presence of OLE_SLACK_ANOMALY and references to VirtualAlloc, LoadLibrary, and GetProcAddress APIs strongly suggest that this Excel file contains malicious code, likely VBA macros. These APIs are commonly used by malware to allocate memory, load dynamic link libraries, and resolve function addresses, which are typical steps for executing a downloaded payload. The large slack space in the OLE structure further supports the presence of hidden or packed code. Without a DOC BODY or SCRIPTS section, the exact nature of the payload and delivery mechanism cannot be determined, leading to an unknown family classification and reduced confidence.

Heuristics 4

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 116,759 bytes but its declared streams total only 24,565 bytes — 92,194 bytes (79%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.