Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 3d1d3cc0bc192192…

MALICIOUS

Office (OLE) / .DOC

82.1 KB Created: 2006-04-29 01:29:00 Authoring application: Microsoft Office Word
MD5: 246d3f7f7fb7e7faa52bf254403354f6 SHA-1: eabfd25005152100aeb1012d16a78577186373e3 SHA-256: 3d1d3cc0bc1921924d453083abfad167f337dcb92f53a4851f67071bab01b86a
282 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1059.001 PowerShell

The file is a malicious OLE document that exhibits characteristics of an exploit, including a NOP sled and references to Windows API functions like CreateProcess, VirtualAlloc, LoadLibrary, and GetProcAddress. ClamAV identified it as Win.Exploit.MSWord-6. Although VBA macros could not be extracted due to an unsupported format, the presence of these API calls strongly suggests the document attempts to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Win.Exploit.MSWord-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Exploit.MSWord-6
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 84,066 bytes but its declared streams total only 26,783 bytes — 57,283 bytes (68%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.

Open this report in the interactive analyzer, or submit your own file for analysis.