MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The sample is a malicious Excel spreadsheet. Static analysis detected a high-severity heuristic indicating an OLE document with a large unaccounted-for region, suggesting obfuscation or embedded malicious content. Another high-severity heuristic identified an x86 GetPC stub, commonly used in shellcode. While no specific document body content or scripts were extracted, these indicators point towards an embedded exploit.
Heuristics 2
-
x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EDI)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 114,058 bytes but its declared streams total only 24,565 bytes — 89,493 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.