Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 e54e2d1a54c39faa…

MALICIOUS

Office (OLE) / .XLS

58.6 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 1fdcd6214ddbad6df68133fb50c1a7f2 SHA-1: 6910cbc6723f77907b5b996f75659809bba7058c SHA-256: e54e2d1a54c39faa9b719baa192c34ecc285d9c1ff2d8c2e1c5d03813ccd66a4
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1218 System Binary Proxy Execution

The sample exhibits high-severity heuristics indicating the use of CreateProcess, LoadLibrary, and GetProcAddress APIs, alongside a suspicious cmd.exe invocation. The presence of a visible LOLBin command execution instruction suggests the document is designed to run external commands. The embedded URLs, while not directly used in the visible command, likely serve as destinations for downloading additional malicious content. No scripts were extracted from this sample.

Heuristics 7

  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 59,961 bytes but its declared streams total only 24,565 bytes — 35,396 bytes (59%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://%s:%d/index.cgi
    • http://%s:%d/index.htm

Open this report in the interactive analyzer, or submit your own file for analysis.