Office (OLE) malware analysis — malicious · 1b7f0978e46c9401

MALICIOUS

Office (OLE)

60.7 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: d36e974c6f797a6c5f329fc13462c5c6 SHA-1: 88332cecde73e19efef245ef8fcb5f13c246e658 SHA-256: 1b7f0978e46c94016bb36a9e596ca22f162defd6b48040ec5f905c1844b4de16

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The OLE document contains a high-severity heuristic firing for a reference to the CreateProcess API, indicating an attempt to launch an external process. The document body is filled with unreadable characters, suggesting it is not intended for direct user interaction but rather to host malicious code. The presence of the CreateProcess API call strongly suggests the macro within the document is designed to download and execute a second-stage payload.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 62,112 bytes but its declared streams total only 21,151 bytes — 40,961 bytes (66%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.