Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 47125e49f1360639…

MALICIOUS

Office (OLE)

133.0 KB
MD5: babee752e1d9144a4ad51aba96d65b7f SHA-1: 88cca674409f73ef5e615adcf2de0814e838cd85 SHA-256: 47125e49f1360639a1a8e2d6e411553c7ce65f967104ac3a4e962f5f20aa8cb4
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1218 System Binary Proxy Execution

The sample exhibits characteristics of a malicious OLE document, including a large slack space anomaly and references to Windows execution APIs such as WinExec, CreateProcess, and LoadLibrary. The presence of 'SE_LOLBIN_RUN_COMMAND' and 'SC_STR_CMD' heuristics strongly suggests the execution of a command-line payload, likely involving cmd.exe. The document body contains what appears to be test data or metadata rather than a user-facing lure.

Heuristics 8

  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 136,192 bytes but its declared streams total only 31,351 bytes — 104,841 bytes (77%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.