Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 14cad027ab0b7855…

MALICIOUS

Office (OLE)

303.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: ed3c8d77faa3ffbce04ddddea8b9af45 SHA-1: f22206be1c806953cb992ea42a2bd7b4b77de82e SHA-256: 14cad027ab0b785587338297e721eeaeb6040768bfbf590754d7d754ffd1c6dd
202 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a malicious Microsoft Word document exploiting CVE-2006-6456, which allows for arbitrary code execution. The presence of WinExec API references and XOR-encoded strings suggests the document attempts to download and execute a secondary payload. The large slack space in the OLE structure is also indicative of obfuscation or embedded malicious content.

Heuristics 5

  • CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456
    WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
  • XOR-encoded strings (key 0xDB) critical SC_XOR_ENCODED
    Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0xDB: 'iphlpapi.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA', 'WSAStartup', 'CreateThread', 'RegOpenKeyExA'
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 310,272 bytes but its declared streams total only 94,801 bytes — 215,471 bytes (69%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.