Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 0141543611cf1bab…

MALICIOUS

Office (OLE) / .DOC

996.0 KB Created: 2009-12-11 11:47:44 Authoring application: Advanced Installer 16.5 build 8df7ad95 First seen: 2026-05-25
MD5: 3269390dcde2522a84ab4cee6d738afb SHA-1: f6a62afb104c87a2c7c6f5dd9085227d679d3839 SHA-256: 0141543611cf1babf0bf8a704d9f4fb28a5728458ae00f68957185ca52e4e549
442 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer

The sample contains heuristics indicating the presence of an embedded PE executable and references to Windows API calls such as CreateProcess, ShellExecute, and LoadLibrary. The detection of ASP webshell indicators and references to PowerShell and WScript suggest the embedded executable is likely a malicious payload designed to be executed. The embedded executable itself is a strong indicator of a loader or dropper.

Heuristics 12

  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    x86 disassembly · validity: code (0.984) — 11/11 branch targets land on an instruction boundary (100% coherence)
    00032CAE  64a130000000      mov eax, dword ptr fs:[0x30]
00032CB4  8b4068            mov eax, dword ptr [eax + 0x68]
00032CB7  c1e808            shr eax, 8
00032CBA  a801              test al, 1
00032CBC  7510              jne 0x32cce
00032CBE  ff7508            push dword ptr [ebp + 8]
00032CC1  ff155cc10310      call dword ptr [0x1003c15c]
00032CC7  50                push eax
00032CC8  ff150cc20310      call dword ptr [0x1003c20c]
00032CCE  ff7508            push dword ptr [ebp + 8]
00032CD1  e84e000000        call 0x32d24
00032CD6  59                pop ecx
00032CD7  ff7508            push dword ptr [ebp + 8]
00032CDA  ff15e0c10310      call dword ptr [0x1003c1e0]
00032CE0  cc                int3
00032CE1  6a00              push 0
00032CE3  ff1560c20310      call dword ptr [0x1003c260]
00032CE9  85c0              test eax, eax
00032CEB  7434              je 0x32d21
00032CED  b94d5a0000        mov ecx, 0x5a4d
00032CF2  663908            cmp word ptr [eax], cx
00032CF5  752a              jne 0x32d21
00032CF7  8b483c            mov ecx, dword ptr [eax + 0x3c]
00032CFA  03c8              add ecx, eax
00032CFC  813950450000      cmp dword ptr [ecx], 0x4550
00032D02  751d              jne 0x32d21
00032D04  b80b010000        mov eax, 0x10b
00032D09  66394118          cmp word ptr [ecx + 0x18], ax
00032D0D  75                .byte 0x75
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • ASP webshell / backdoor source high WEBSHELL_ASP
    The file contains classic ASP webshell code — eval/Execute over Request input, or WScript.Shell.Run of request data — i.e. server-side remote-command-execution backdoor source.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://t2.symcb.com0 In document text (OLE body)
    • http://tl.symcd.com0&In document text (OLE body)
    • http://s.symcd.com06In document text (OLE body)
    • http://ts-ocsp.ws.symantec.com0In document text (OLE body)
    • http://t1.symcb.com/ThawtePCA.crl0In document text (OLE body)
    • http://tl.symcb.com/tl.crl0In document text (OLE body)
    • https://www.thawte.com/cps0/In document text (OLE body)
    • https://www.thawte.com/repository0WIn document text (OLE body)
    • http://tl.symcb.com/tl.crt0In document text (OLE body)
    • https://www.advancedinstaller.comIn document text (OLE body)
    • https://d.symcb.com/cps0%In document text (OLE body)
    • https://d.symcb.com/rpa0In document text (OLE body)
    • http://s.symcb.com/universal-root.crl0In document text (OLE body)
    • https://d.symcb.com/rpa0@In document text (OLE body)
    • http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0In document text (OLE body)
    • http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(In document text (OLE body)
🗂 Part of campaign: symcd.com06 24 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00009400.exe embedded-pe Office MZ+PE at offset 0x9400 982016 bytes
SHA-256: ac243f839631e133022b831f5196637247ca009c8a0b713f12302f09cd2b725a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_SHELLEXEC, SC_STR_LOADLIBRARY Static shellcode analysis recovered API/import strings: shell32.dll, ShellExecuteW, LoadLibraryW, GetProcAddress, kernel32.dll, KERNEL32.DLL Static shellcode analysis recovered command string(s): Wscript.Shell"), powershell Start-Sleep -Seconds 900; Restart-Computer -Force",0,falseAI_ResolveKnownFoldersLaunchLogFileAI_STORE_LOCATIONARPINSTALLLOCATION[APPDIR]SET_APPDIR[ProgramFiles

Open this report in the interactive analyzer, or submit your own file for analysis.