Office (OLE) malware analysis — malicious · 28c1513124d244ec

MALICIOUS

Office (OLE)

41.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14

MD5: feffd9cdf5c3a0a3a31c2e16efc8aecc SHA-1: 325357f5ace4ab2a333c914c752f985f9d01af55 SHA-256: 28c1513124d244ecbc5f0cf731dc62113f49189f8f59ee5fdb43bc1b178293a9

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The analysis identified critical and high-severity heuristics related to OLE document structure, specifically large unaccounted-for regions and empty streams, indicating an attempt to obfuscate or corrupt the file to evade detection. The presence of embedded office content further supports a malicious intent, likely as a spearphishing attachment. No specific IOCs were extracted beyond the structural anomalies.

Heuristics 3

Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 30,926 bytes but its declared streams total only 0 bytes — 30,926 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00002b32.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x2B32	30926 bytes
SHA-256: `1981837f0158fc0de80c566ba3dc5c554dfbc9769b3a9c2c65c697058b7b0c17`

Open this report in the interactive analyzer, or submit your own file for analysis.