Office (OLE) / .XLS malware analysis — malicious · e90b82b47075cce8

MALICIOUS

Office (OLE) / .XLS

313.9 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: efb9d328df88c25b8f3a9d134938d989 SHA-1: 1e8804cd0d00bfbcaa828b11f3f590221d66ef53 SHA-256: e90b82b47075cce86d1707802bd95671e470185d39f7a6cb94436c733dfe9d87

400 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information

The sample is an OLE Excel file exhibiting a large slack space anomaly and containing NOP sleds, indicating potential shellcode. Heuristics indicate the use of WinExec, ShellExecute, VirtualAlloc, VirtualProtect, CreateRemoteThread, LoadLibrary, and GetProcAddress, suggesting the execution of injected code. The XOR-encoded strings (key 0x90) further point to obfuscation techniques. While no specific document body content directly indicates malicious intent beyond generic application forms, the combination of these low-level API calls and obfuscation strongly suggests the file is a loader for a second-stage payload.

Heuristics 10

Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
XOR-encoded strings (key 0x90) critical SC_XOR_ENCODED

Found 5 Windows library/API name(s) XOR-encoded with single-byte key 0x90: 'kernel32.dll', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'HttpOpenRequestA'
NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 321,472 bytes but its declared streams total only 21,308 bytes — 300,164 bytes (93%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.