Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0f580387862409ba…

MALICIOUS

Office (OLE)

563.9 KB First seen: 2020-07-24
MD5: 7be6d13bf2286ded219279aec151482e SHA-1: 302e8852db7bbde5833fcb89e419db8b5cf04542 SHA-256: 0f580387862409baee3711570fc08799403ff85936d076fb28d29464d62d0fe9
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is an encrypted and malformed Office document, which is a common tactic to evade static analysis and hide malicious payloads. The encryption and structural corruption suggest an attempt to conceal the true nature of the file, likely as part of a phishing campaign.

Heuristics 2

  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).

Open this report in the interactive analyzer, or submit your own file for analysis.