Office (OLE) malware analysis — malicious · 46617920c7778222

MALICIOUS

Office (OLE)

302.7 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: ccf47fc78acacb8e5ecf842291726835 SHA-1: 70ba2682933074bac3ab6235068b15fe3503171b SHA-256: 46617920c77782229d360dba3f0cf97014dddeb5937e1ae8eb2afb41d4d290fa

340 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded content. Crucially, it contains an embedded PE executable. Heuristics indicate the use of APIs like CreateProcess, ShellExecute, URLDownloadToFile, VirtualAlloc, LoadLibrary, and GetProcAddress, suggesting the embedded executable is likely downloaded or executed by the document. The presence of an embedded executable strongly points to a delivery mechanism for a secondary payload.

Heuristics 8

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 309,920 bytes but its declared streams total only 21,151 bytes — 288,769 bytes (93%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00015f10.exe` `92e5d0a64ad8fed962bffdce41c9419fa762836e7931bf2822a7a58dc752e292`	embedded-pe	Office MZ+PE at offset 0x15F10	220048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.