Office (OLE) / .XLS malware analysis — malicious · e50b7220d39a4f8b

MALICIOUS

Office (OLE) / .XLS

1.86 MB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2026-06-19

MD5: f2854a33e9ffea41a216ffdb96964a99 SHA-1: ae8f0d4d1ae03fb505744b800e0a1b9aa3307e2e SHA-256: e50b7220d39a4f8bad3401b25c352f488562530a55b12d017ca277c40dba0dda

104 Risk Score

Heuristics 4

OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199

Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
VBA project contains no executable statements info OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://arpo-sa.com/ In document text (OLE body)
- https://peprolinbot.es/uAADj2?&ankleIn document text (OLE body)
- http://evertype.comhttp://tulrich.comCopyrightIn document text (OLE body)
- http://scripts.sil.org/OFLIn document text (OLE body)
- http://scripts.sil.org/OFLRupakaraRegularRupakaraIn document text (OLE body)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1206 bytes
SHA-256: `7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`font_00_sfnt_off000010ab.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10AB	88240 bytes
SHA-256: `41c2901ebda5b5d79d4a68e71278578ac4fe004bea942385b0ed0c502c07b584`
`polyglot_child_pdf_off00136a00.pdf`	polyglot-child-pdf	Secondary PDF body inside ole container at offset 0x136A00	678416 bytes
SHA-256: `ac951b6be297f6dffd4c27a5316007b3145ef9b2ab927cacc52aaf0000575695`

Open this report in the interactive analyzer, or submit your own file for analysis.