Office (OLE) / .TMP malware analysis — malicious · e277137b96c6aa9b

MALICIOUS

Office (OLE) / .TMP

314.6 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel

MD5: 15cf660ca0dca1b2cac585025fba0fe2 SHA-1: 93b0d6393c4fd5755261396789e1b1657bf6e2c7 SHA-256: e277137b96c6aa9bff0e9d8cd2365095a8148db45e083d0765c4cb90e19d72fa

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file is an Excel document containing both VBA and XLM macros, with a Workbook_Open macro detected. The presence of XOR-encoded strings and a large slack space anomaly suggests obfuscation and potentially hidden malicious content. The macros themselves appear to be part of a game-like interface, but the overall structure and heuristic firings indicate a malicious intent, likely to download and execute further payloads.

Heuristics 6

XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED

Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'iphlpapi.dll', 'LoadLibraryW', 'LoadLibraryW', 'GetProcAddress', 'GetProcAddress', 'CreateProcessA', 'InternetOpenW', 'HttpOpenRequestW'
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 322,108 bytes but its declared streams total only 184,311 bytes — 137,797 bytes (43%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
`macros.bas` `58e98bd0e02086f4984bd1bb54b8e988e0c76b5ab574ab10f03f6f4aeb96a8f5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27433 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 30 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.