Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1f09aed5cce81fa2…

MALICIOUS

Office (OLE)

115.6 KB
MD5: e82d2f7d7e0b072ef437ec5161608953 SHA-1: a650254ab209992c24b50783dd4cb34981758a0f SHA-256: 1f09aed5cce81fa249aab42808f3ddc0ddbe16a079304511ab4ee23b7811551b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter T1204 Malicious Link T1027 Obfuscated Files or Information

The sample exhibits characteristics of a malicious Office document, including a large slack space anomaly and references to APIs like VirtualProtect, LoadLibrary, and GetProcAddress, suggesting code injection or unpacking. The embedded URL, though benign, is noted. The document body is heavily obfuscated and truncated, preventing a clear understanding of its user-facing lure.

Heuristics 5

  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 118,336 bytes but its declared streams total only 8,934 bytes — 109,402 bytes (92%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.