Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 193cdbaf057afd05…

MALICIOUS

Office (OLE)

115.6 KB
MD5: 57c496f361849c9643e637c7a8c13d08 SHA-1: 44b93ac563486c0ed818c05bcb1094f1c042dc94 SHA-256: 193cdbaf057afd052f18c6471c95ba33bb48a9af4788516e125e53cdba4c6b6b
162 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1218.011 Signed Binary Proxy Execution: Rundll32

The sample is an OLE document with a large slack space anomaly, indicating potential obfuscation or embedded content. High-severity heuristics indicate the use of Windows API functions like VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress, commonly used by malware to allocate memory and load malicious code. While no specific malicious URLs were extracted, the presence of these API calls strongly suggests the document's VBA macros are designed to download and execute a second-stage payload.

Heuristics 6

  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 118,384 bytes but its declared streams total only 56,346 bytes — 62,038 bytes (52%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com
    • https://www.verisign.com/rpa
    • http://ocsp.verisign.com/ocsp/status0
    • https://www.verisign.com/rpa0
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.