Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dd561d0f7e3a6df5…

MALICIOUS

Office (OLE)

116.4 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: a31429a8fd0b73572f71b795743791a3 SHA-1: d2177926617a8bd5e82f9f17ae7c6debe002ca6a SHA-256: dd561d0f7e3a6df55ca956e310eeca7f6f5587e3b8b593ae0fd281cc8ed19bc2
80 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1204.002 Malicious File: User Execution

The sample is an OLE document with a high slack space anomaly, indicating potential obfuscation or embedded malicious content. The presence of an x86 GetPC stub heuristic firing suggests the use of shellcode, commonly employed to exploit vulnerabilities. Given these indicators, the most likely attack pattern is exploitation of a Microsoft Excel vulnerability.

Heuristics 2

  • x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EDI)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 119,178 bytes but its declared streams total only 24,565 bytes — 94,613 bytes (79%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.