Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 de000c067eb479ce…

MALICIOUS

Office (OLE) / .XLS

79.5 KB
MD5: f0ba6a94150a1a06e0ffedd4b1b4e1e0 SHA-1: f0f0f9d385409f6159b92a5ea2fc7baade682bb4 SHA-256: de000c067eb479ce610c9e83deb55516eb5741516faab123c5e8cd2014abacd8
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.010 Python T1059.011 Azure CLI

The sample exhibits high-confidence heuristic firings related to PEB access and API hash resolution, indicating sophisticated evasion techniques. Although no VBA macros could be extracted due to an unsupported format, the presence of these heuristics strongly suggests the file functions as a loader or dropper. The embedded URLs are confirmed benign and do not provide further IOCs. The confidence is moderate due to the inability to analyze VBA content directly.

Heuristics 5

  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (AttributeError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com
    • https://www.verisign.com/rpa
    • http://ocsp.verisign.com/ocsp/status0
    • https://www.verisign.com/rpa0
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.