Malicious Office (OLE) / .EXE — malware analysis report

Static analysis result for SHA-256 1645861df489d8d2…

MALICIOUS

Office (OLE) / .EXE

20.0 KB Created: 1993-09-28 16:08:00 Authoring application: Microsoft Word for Windows 95
MD5: f36c39683c1128bf4fc74dc5d208fd19 SHA-1: ad4b0de0ccf656520a86150d98b1c126c7f1d22d SHA-256: 1645861df489d8d23c0c652e6038a93a9843cf34f9710decdac66c3bc76a94fd
80 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Phishing: Spearphishing Attachment

The sample is an OLE file with critical heuristic firings indicating a malformed structure designed to bypass parsers and potentially exploit vulnerabilities. The embedded OLE structure suggests it's likely delivered as an attachment, aiming to execute malicious code upon opening. The specific exploit mechanism is unclear due to the nature of the OLE parsing errors, but the intent is to achieve code execution.

Heuristics 2

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00002100.ole
9e590b961c567e64a25ffe6d7adb8a788ca8a9a812fdcfb5fb3667f4864c8e80		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x2100 12032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.