Malicious Office (OLE) / .DOT — malware analysis report

Static analysis result for SHA-256 0ac99a2952b9151c…

MALICIOUS

Office (OLE) / .DOT

32.5 KB Created: 1997-05-02 22:54:00 Authoring application: Microsoft Word 8.0
MD5: f1f5ba33d487b673e5990c2a3a34f62d SHA-1: 0f99f47a4354335262c037e548760112b7b2e3c2 SHA-256: 0ac99a2952b9151c5fc6a0f278a5e41a5e7ec811e88fcd287fcd5038cb4d2404
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OLE document containing a VBA macro with an AutoOpen subroutine, indicating it is designed to execute malicious code automatically when opened. The macro code appears to be a variant of the D0EUNPAD virus, which historically downloads and executes secondary payloads. While the specific payload URL is not directly visible, the presence of the AutoOpen macro and the virus's known behavior strongly suggest this intent. The document body contains strings related to virus infection and template paths, further supporting the malicious nature.

Heuristics 5

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 26,560 bytes but its declared streams total only 0 bytes — 26,560 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
993d2ee0cd71ace655e838893edbe1638c12b1b9210d1bb480920c62d091605d		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1920 bytes
embedded_office_off00001a40.ole
87389019c7b3eb004f0d22710f8f9d53ccbb46e3108b4d702d3ac493c4f4c047		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x1A40 26560 bytes
embedded_office_off00004000.ole
fe49d118aee5415d5f34a05e5f8a5eab5c4390e8a0e98f8a93b7d385edfe1f27		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x4000 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.