MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The sample is an OLE file with significant slack space and anomalous stream parsing, indicating potential obfuscation or deliberate corruption to evade detection. The document body contains what appear to be internal filenames and macro names, suggesting it was designed to execute embedded code. The embedded OLE object is the primary indicator of malicious intent.
Heuristics 3
-
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGEA CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 60,927 bytes but its declared streams total only 0 bytes — 60,927 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMSThe file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_off00002e01.ole48d8476b9459fbc9b0e3ecd972a8d15fc3d59211c7efc6c8098cdaf39a016dba |
embedded-office | Embedded OLE/CFB Office body inside ole container at offset 0x2E01 | 60927 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.