Office (OLE) / .XLS malware analysis — malicious · d704650afbfe3af0

MALICIOUS

Office (OLE) / .XLS

557.6 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: 65969ba7b391b7f742333bb6488b6d9f SHA-1: c03a4f3d91054946c3e0d64008f16027fe951513 SHA-256: d704650afbfe3af01a4fc42628b73aff8d3d1e9c0c129ccb80e0f4c97d0772b9

260 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059.003 Windows Command Shell

This OLE file contains both VBA and XLM macros, with a Workbook_Open VBA macro detected. The VBA macro appears to initiate a game-like interface, potentially as a distraction or lure. The presence of XOR-encoded strings and an appended payload suggests the file is designed to download and execute further malicious content. The XLM macro is truncated, and the VBA macro's full functionality is obscured by obfuscation, limiting a precise understanding of its ultimate payload delivery.

Heuristics 7

XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED

Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualProtect'
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 570,940 bytes but its declared streams total only 184,311 bytes — 386,629 bytes (68%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `86cb1ca881ed55b4e31c731d0891c828e84bd23ac05556a9f0000b2a6f0e4901`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.