Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 16f1c8a684935fc8…

MALICIOUS

Office (OLE) / .DOC

122.5 KB
MD5: 1a15d8c62bb0d8695fd57b5e67eec959 SHA-1: c82c1fc808ebeb4f35a24846c637c15cb5cdc592 SHA-256: 16f1c8a684935fc8f05d3623f98963408b0040f57561bc50516c5ef9f963a4b9
162 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a malicious OLE document exhibiting a large slack space anomaly and containing embedded EMF objects. It references LoadLibrary and GetProcAddress APIs, indicating an attempt to dynamically load code. The document body contains references to embedded Excel and PowerPoint objects, further supporting the malicious nature.

Heuristics 5

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 125,440 bytes but its declared streams total only 31,351 bytes — 94,089 bytes (75%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main