Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 556ed1719ccb9419…

MALICIOUS

Office (OLE) / .DOC

999.0 KB Created: 2009-12-11 11:47:44 Authoring application: Advanced Installer 15.9 build daae28bc First seen: 2026-05-11
MD5: 0a43274c39e4906a2c8005f7cf33886c SHA-1: cdfb4e48d5a6c7299bb78d309fac8662918520d6 SHA-256: 556ed1719ccb9419b7cefa305e5b35abebf582c962cfa564fa813461ec9aa2ad
342 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document containing an embedded PE executable, identified as 'embedded_office_0000a000.exe'. Heuristics also indicate references to CreateProcess and ShellExecute APIs, suggesting the execution of this embedded payload. Furthermore, a critical heuristic flags this as a travel-support phone-number stuffing scam, indicating a deceptive social engineering attempt. The presence of the embedded executable and the scam-related heuristics strongly suggest an attack pattern involving the delivery of a malicious payload via a document attachment, likely for further malicious activity.

Heuristics 9

  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    x86 disassembly · validity: code (0.984) — 10/10 branch targets land on an instruction boundary (100% coherence)
    000450F5  64a130000000      mov eax, dword ptr fs:[0x30]
000450FB  8b4068            mov eax, dword ptr [eax + 0x68]
000450FE  c1e808            shr eax, 8
00045101  a801              test al, 1
00045103  7510              jne 0x45115
00045105  ff7508            push dword ptr [ebp + 8]
00045108  ff1504510510      call dword ptr [0x10055104]
0004510E  50                push eax
0004510F  ff1558500510      call dword ptr [0x10055058]
00045115  ff7508            push dword ptr [ebp + 8]
00045118  e84f000000        call 0x4516c
0004511D  59                pop ecx
0004511E  ff7508            push dword ptr [ebp + 8]
00045121  ff1538500510      call dword ptr [0x10055038]
00045127  cc                int3
00045128  6a00              push 0
0004512A  ff1530510510      call dword ptr [0x10055130]
00045130  8bc8              mov ecx, eax
00045132  85c9              test ecx, ecx
00045134  7503              jne 0x45139
00045136  32c0              xor al, al
00045138  c3                ret
00045139  b84d5a0000        mov eax, 0x5a4d
0004513E  663901            cmp word ptr [ecx], ax
00045141  75f3              jne 0x45136
00045143  8b413c            mov eax, dword ptr [ecx + 0x3c]
00045146  03c1              add eax, ecx
00045148  813850450000      cmp dword ptr [eax], 0x4550
0004514E  75e6              jne 0x45136
00045150  b90b010000        mov ecx, 0x10b
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://senac3.s3.us-east-2.amazonaws.com/MiniGame.zipPROMPTROLLBACKCOSTPAppsShutdownOptionAllButtonText_RepairRe&pararProductLanguage1046AiPreferFastOemProductVersion1.0.0DialogBitmapdialog{9D9373A7-54DD-48EF-B2A1-FA35A8B8EC93}ButtonText_OKOKErrorDialogErrorDlgEnableUserControlButtonText_Back In document text (OLE body)
    • http://www.winimage.com/zLibDllIn document text (OLE body)
    • http://s.symcd.com06In document text (OLE body)
    • http://ts-ocsp.ws.symantec.com0In document text (OLE body)
    • https://www.advancedinstaller.comIn document text (OLE body)
    • https://d.symcb.com/cps0%In document text (OLE body)
    • https://d.symcb.com/rpa0In document text (OLE body)
    • http://s.symcb.com/universal-root.crl0In document text (OLE body)
    • https://d.symcb.com/rpa0@In document text (OLE body)
    • http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0In document text (OLE body)
    • http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(In document text (OLE body)
🗂 Part of campaign: symcd.com06 24 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_0000a000.exe embedded-pe Office MZ+PE at offset 0xA000 982016 bytes
SHA-256: bb8474b8b3e55a2fd271fda2feceee11ed160fe017efbd2c432344eedc69cf79
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_LOADLIBRARY, SC_STR_SHELLEXEC Static shellcode analysis recovered API/import strings: LoadLibraryW, GetProcAddress, shell32.dll, ShellExecuteW, kernel32.dll, KERNEL32.DLL

Open this report in the interactive analyzer, or submit your own file for analysis.