Office (OLE) malware analysis — malicious · 577ca04198f64ebb

MALICIOUS

Office (OLE)

123.5 KB

MD5: 9d24c8149b36a6f5bcd1daa16cdbdf96 SHA-1: 6c5218191220c2a2eee1cd5ab646d95bbf99cfd3 SHA-256: 577ca04198f64ebb679f22bc91539867a230e7c6b5be80fde74227fe4b1ada93

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OLE document with a significant slack space anomaly and an embedded PE executable. Heuristics indicate references to LoadLibrary and GetProcAddress APIs, which are commonly used by malware to load dynamic link libraries and resolve function addresses. This suggests the embedded executable is likely malicious and intended to be loaded and executed by the OLE document. No specific malware family could be confidently identified.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 126,464 bytes but its declared streams total only 56,346 bytes — 70,118 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded PE executable high OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.microsoft.com
- https://www.verisign.com/rpa
- http://ocsp.verisign.com/ocsp/status0
- https://www.verisign.com/rpa0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

Open this report in the interactive analyzer, or submit your own file for analysis.