MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1559.001 Component Object Model Hijacking
The analysis identified embedded OLE objects with critical static findings related to OLE directory cycles and FAT chain loops. These anomalies suggest the file structure may be intentionally corrupted or manipulated to evade detection. The presence of these indicators points towards a potential attempt to hide or execute malicious code within the compound document.
Heuristics 2
-
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGEA CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
-
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMSThe file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_off00002afc.ole |
embedded-office | Embedded OLE/CFB Office body inside ole container at offset 0x2AFC | 6404 bytes |
SHA-256: 3c0226d1a9a94b88bbfd1010fa98adc932d712873561a87c0dbe63f03dfa4a33 |
|||
embedded_office_off00003355.ole |
embedded-office | Embedded OLE/CFB Office body inside ole container at offset 0x3355 | 4267 bytes |
SHA-256: f19197356025ef4fb5daf6024705779accc9bfba23a7f5df2a97d8951ed7c5a8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.