Office (OLE) / .XLS malware analysis — malicious · f027b06afaa7e042

MALICIOUS

Office (OLE) / .XLS

159.3 KB

MD5: 9c2a558de816b1bd21c314bb9717f808 SHA-1: 691a4bf91f2ae25437480f72bfd44799e3158b78 SHA-256: f027b06afaa7e04282f1f6ecaaea12fe520bdf04eb5435119a6930532f149ced

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is an OLE document with a significant slack anomaly, indicating potential obfuscation or embedded malicious content. Heuristics indicate references to VirtualProtect, LoadLibrary, and GetProcAddress APIs, commonly used by malware to load and execute code. While no scripts were extracted, the presence of embedded URLs, even if currently benign, suggests a delivery mechanism. The overall structure and API calls point towards a downloader or dropper, though the specific family is not identifiable.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 163,083 bytes but its declared streams total only 56,346 bytes — 106,737 bytes (65%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.microsoft.com
- https://www.verisign.com/rpa
- http://ocsp.verisign.com/ocsp/status0
- https://www.verisign.com/rpa0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.