Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 240821416fe17851…

MALICIOUS

Office (OLE) / .DOC

16.0 KB First seen: 2026-03-07
MD5: e68ddd1d7caa97e6bd6fdebf3aebdc40 SHA-1: 60644c9c0b7ab619ff0719bb39c8d6770aac61d7 SHA-256: 240821416fe1785124e5e24fe953b8b87b4ce2798f296351026fab8e80726aca
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1059.003 Windows Command Shell

The sample contains an embedded OLE object that, when processed, reveals a PowerShell script. This script is designed to download a file from 'http://www.sunamien.jp/cgi/up/uploader.cgi?mode=downld&no=55' to 'C:\Users\Public\Downloads\python312x86.zip', then move it to the user's AppData\Roaming\Templates directory. Finally, it attempts to extract the archive and execute 'Protected.py' using 'pythonw.exe', indicating a multi-stage infection process. The presence of Equation Editor and suspicious command-line invocations further supports this malicious intent.

Heuristics 6

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 16,384 bytes but its declared streams total only 0 bytes — 16,384 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sunamien.jp/cgi/up/uploader.cgi?mode=downld&no=55