Office (OLE) / .DOC malware analysis — malicious · 4a5a8374b4ec3c14

MALICIOUS

Office (OLE) / .DOC

66.4 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 1bbf98772e6ce4dbedff9bdd482ac7db SHA-1: 99d2bc46e599be7eb5e91d086bab129ac6cee9df SHA-256: 4a5a8374b4ec3c145075f23b9d8f3b01356a3cb5c634cb327c2f4d1e12191a1c

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The presence of a CreateProcess API reference in the OLE document suggests an attempt to execute a secondary payload. The large slack space in the OLE structure is also indicative of malicious packing or obfuscation techniques. Without a document body or script content, the exact nature of the attack is unclear, but the heuristics point towards a classic exploit document.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 68,000 bytes but its declared streams total only 21,151 bytes — 46,849 bytes (69%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.