Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 441e998f8a7b7100…

MALICIOUS

Office (OLE) / .DOC

317.5 KB Created: 2007-09-18 04:34:00 Authoring application: Microsoft Word 11.
MD5: b95b422525fb270fde34665134ddcdda SHA-1: 93f8f4cb8eb9c530fa8742a472ee8acdf693709b SHA-256: 441e998f8a7b710096cc15900fce4d8729076727f6a3da693a5855415a7ca7a9
80 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1059 Command and Scripting Interpreter

The sample exhibits a high degree of slack space within the OLE structure, a common indicator of packed or obfuscated malicious content. Additionally, a PEB access heuristic suggests attempts to evade detection or manipulate process information. The document body contains VBA-like function calls that reconstruct registry paths and filenames, indicating an attempt to establish persistence or modify system settings. Specifically, it appears to be writing to 'HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\3' and 'HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\1.doc', likely to disable security features or ensure continued execution.

Heuristics 2

  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 325,120 bytes but its declared streams total only 16,486 bytes — 308,634 bytes (95%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.