Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 f30ecca55c1a5c27…

MALICIOUS

Office (OLE) / .XLS

449.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel
MD5: 83ee185562ee68924b96e955fae0288c SHA-1: 2651e918e6ea1aa228cdf0b4d2bcbda43c491c81 SHA-256: f30ecca55c1a5c272f1cdf82b8f3dbb18689a689a98fe77d3f50ab249665ab07
108 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The sample is an Excel file that leverages the CVE-2017-0199 vulnerability via an OLE2Link object. This vulnerability allows for the download and execution of a remote payload from the URL 'https://jamp.to/QSsf4p'. Additionally, an embedded PDF with suspicious static findings was detected, suggesting a multi-stage attack. The presence of PDF JavaScript further indicates potential for malicious script execution.

Heuristics 4

  • OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jamp.to/QSsf4pB��/#��h��{U7��]5�M���R�����VPq61ZY5oXkhCWpMqhRa06dr���������������������������������������������������������������������������������������������������������������������������������������%PDF-1.5

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
polyglot_child_pdf_off00000e00.pdf
7b4576ff62ff648af955d2d331e88b3cf4f727a47ac20c5949b8cdf9d3c2b04d		 polyglot-child-pdf Secondary PDF body inside ole container at offset 0xE00 456704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.