Office (OLE) malware analysis — malicious · e98fb6bbb9781486

MALICIOUS

Office (OLE)

510.5 KB Created: 2010-04-28 05:20:10 Authoring application: Microsoft Excel First seen: 2019-03-18

MD5: cad3103523ba99008223b348c371d8b9 SHA-1: 9b8c8d50606f47e0fa86b819e7e2dc996fbb3f82 SHA-256: e98fb6bbb9781486ff95ca6d48be4e9f2d62b276390b0fd440a64f4ec971ae93

300 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is a malicious Microsoft Excel document identified as containing an embedded PE executable. Heuristics indicate the use of WinExec, ShellExecute, VirtualAlloc, LoadLibrary, and GetProcAddress APIs, suggesting dynamic code loading and execution. The embedded executable is the primary indicator of malicious intent, likely serving as a second-stage payload. The document body content appears benign, suggesting the lure is not within the text itself.

Heuristics 7

Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00001a77.exe`	embedded-pe	Office MZ+PE at offset 0x1A77	515977 bytes
SHA-256: `7ad8396e862118b32e4ffd956e444ea20b054aae71608dd8edd9ff73c25bf800`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: MBD0003267A/Ole10Native	471767 bytes
SHA-256: `2f7cdb9d5b8e1b1f103df64d61a9e065b26883c4a513115a785100b9ae8416ab`

Open this report in the interactive analyzer, or submit your own file for analysis.