Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 33cbfbcf77a53aa3…

MALICIOUS

Office (OLE) / .DOC

106.9 KB Created: 2005-06-29 18:14:00 Authoring application: Microsoft Word 10.0
MD5: 5ad4dc990b1d78864efaa22981b69364 SHA-1: cb8c2cd6acc76e1078c993c323bdb852f8cd9eb9 SHA-256: 33cbfbcf77a53aa3e280c244a3924e8e140daf291efb7906dd112ce60755d5ad
260 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell T1204.001 Malicious Link T1059.003 Windows Command Shell

The sample is a Microsoft Word document exhibiting OLE slack anomalies and multiple high-severity heuristic firings related to PEB access, API hash resolution, and the use of VirtualAlloc, LoadLibrary, and GetProcAddress. These indicators suggest the document contains shellcode designed to download and execute a second-stage payload, likely from the URL http://www.example.com/payload.exe. The presence of these low-level API calls and memory allocation functions points towards a sophisticated exploit or downloader mechanism.

Heuristics 7

  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 109,473 bytes but its declared streams total only 20,632 bytes — 88,841 bytes (81%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API