Office (OLE) malware analysis — malicious · 0e48231662887c53

MALICIOUS

Office (OLE)

123.7 KB Created: 2007-09-18 04:34:00 Authoring application: Microsoft Word 11.

MD5: 9bd8c1154fbe1dd7124cfee5a5c0a4b3 SHA-1: 3769bae40b438c4e549ad296b301aa3c6a0fc6a6 SHA-256: 0e48231662887c53f36b518169dd62b29936bb8129f0726152c95aa8f8e3aaa0

82 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample exhibits a high slack anomaly in its OLE structure and triggers a heuristic for PEB access, suggesting an attempt to exploit a vulnerability. The presence of embedded URLs, including one to 'www.iec.ch', indicates a potential command and control or payload download vector. The document body contains obfuscated strings that appear to be API calls for file operations and execution, further supporting the exploitation and payload delivery hypothesis.

Heuristics 3

PEB access via FS segment (x86) high SC_PEB_ACCESS

PEB access via FS segment (x86)
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 126,680 bytes but its declared streams total only 16,486 bytes — 110,194 bytes (87%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://ns.adobe.com/photoshop/1.0/
- http://ns.adobe.com/tiff/1.0/
- http://ns.adobe.com/exif/1.0/
- http://www.iec.ch

Open this report in the interactive analyzer, or submit your own file for analysis.