Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 11257ad0d2317b6a…

MALICIOUS

Office (OLE)

128.0 KB Created: 2010-03-22 19:56:00 Authoring application: Microsoft Office Word First seen: 2015-09-29
MD5: a1d62e0a17b5d18e197d81cc30d0f280 SHA-1: 9b580159b5bf13448a2d7c65e017d3d6e2e6a8c6 SHA-256: 11257ad0d2317b6aaebddff96e22527e9f2c40d894db2e0fac1a8e20c92d836a
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The OLE document exhibits characteristics of a dropper, including a large appended payload and references to VirtualAlloc, LoadLibrary, and GetProcAddress APIs, which are frequently used to load and execute malicious code. The presence of these indicators strongly suggests the file is designed to deliver a secondary stage payload.

Heuristics 6

  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 131,072 bytes but its declared streams total only 65,394 bytes — 65,678 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.