Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 51d4b5c6ede91321…

MALICIOUS

Office (OLE) / .DOC

45.5 KB Created: 2000-09-08 09:42:00 Authoring application: Microsoft Word 8.0 First seen: 2026-06-18
MD5: 73625ad8c95d42cb64caf69619a97cba SHA-1: fe99d10de5259ca0cbc4e9e8f46a6848522aa030 SHA-256: 51d4b5c6ede91321f8d7bcf261284097e051840bc232328087a4ff0558ccbedc
60 Risk Score

Heuristics 2

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 46,592 bytes but its declared streams total only 17,052 bytes — 29,540 bytes (63%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.