Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3711680dbdaf95a2…

MALICIOUS

Office (OLE)

218.5 KB Created: 2015-03-19 03:16:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: 53c7d3dc413eb9334317a16e6cd546a1 SHA-1: cba6b1791bdc7333dfec4961e16029653ccaacdd SHA-256: 3711680dbdaf95a2ec3e673ece4fdb4373c12b512be1582e9aa1c9deb0103064
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a Korean job application form, presented as a lure to collect user data. While the VBA macro itself is empty, the embedded OLE object exhibits suspicious static findings, including slack space anomalies and unreadable streams, suggesting an attempt to evade static analysis. The presence of an embedded URL in the document body, though benign, combined with the overall structure, points towards a phishing or information-gathering attack.

Heuristics 5

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 157,952 bytes but its declared streams total only 0 bytes — 157,952 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/officeDocument/2006/bibliography In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1424 bytes
SHA-256: 7cd0ee60753c6cb8ca2d33f5c2fb54adcca38022506a29d0be38fdf57ed03881
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "OptionButton1, 0, 0, MSForms, OptionButton"
Attribute VB_Control = "OptionButton2, 1, 1, MSForms, OptionButton"
Attribute VB_Control = "CheckBox1, 2, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 3, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 4, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 5, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 6, 6, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 7, 7, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 8, 8, MSForms, CheckBox"
Attribute VB_Control = "CheckBox8, 9, 9, MSForms, CheckBox"
Attribute VB_Control = "CheckBox51, 10, 10, MSForms, CheckBox"
Attribute VB_Control = "CheckBox61, 11, 11, MSForms, CheckBox"
Attribute VB_Control = "CheckBox71, 12, 12, MSForms, CheckBox"
Attribute VB_Control = "CheckBox81, 13, 13, MSForms, CheckBox"
Attribute VB_Control = "CheckBox53, 14, 14, MSForms, CheckBox"
Attribute VB_Control = "CheckBox63, 15, 15, MSForms, CheckBox"
Attribute VB_Control = "CheckBox73, 16, 16, MSForms, CheckBox"
Attribute VB_Control = "CheckBox83, 17, 17, MSForms, CheckBox"
embedded_office_off00010100.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x10100 157952 bytes
SHA-256: 6010f2398e27e1a0dbed5b3a8df367da62eb8c0829b0c2f7e9cfc789e26aaaf6

Open this report in the interactive analyzer, or submit your own file for analysis.