Office (OLE) malware analysis — malicious · 1927d735d99ec939

MALICIOUS

Office (OLE)

77.8 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: c3f327eb1b923af135d202c576b96f43 SHA-1: 3c68456e13c1a0b27e3685d1a6d782622ae8daaf SHA-256: 1927d735d99ec939f8bea3c293639b762460de4d5d3403d248e6a59513596bc1

360 Risk Score

Malware Insights

MITRE ATT&CK

T1055 Process Injection T1204.002 Malicious File

The sample is a malicious Office document that exhibits strong indicators of process injection. Heuristics indicate the use of critical Windows API functions such as WriteProcessMemory and CreateRemoteThread, along with LoadLibrary and GetProcAddress, suggesting the loading and execution of a secondary payload. The large slack space in the OLE structure further supports the possibility of embedded malicious content. No document body or script content was available for analysis, limiting the ability to identify specific lures or obfuscation techniques.

Heuristics 9

Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 79,700 bytes but its declared streams total only 21,151 bytes — 58,549 bytes (73%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.