Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 f0937ac451d630f1…

MALICIOUS

Office (OLE) / .XLS

74.8 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 889adf746e93966deaf6d2b7fc986e2c SHA-1: abf17eeab972acdb4674de32a6e68d01bd670070 SHA-256: f0937ac451d630f19da6db951245d36bff8ff255cc3c91224cdb60081791c7ef
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The sample is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. The presence of a VirtualAlloc API reference suggests the execution of code. The document body presents itself as various application forms, a common lure for social engineering. Without extracted scripts or URLs, the exact payload and delivery mechanism remain unclear, leading to a lower confidence score.

Heuristics 2

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 76,622 bytes but its declared streams total only 21,308 bytes — 55,314 bytes (72%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.