Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5f9e09204885f3cb…

MALICIOUS

Office (OLE)

37.8 KB First seen: 2020-08-10
MD5: bc6854bcb063dfc3661c76550b5da1db SHA-1: 9697b8da4d94083b0e8e58ee9d6c86031f7c5504 SHA-256: 5f9e09204885f3cb16704b51919feeb8db44123da4dabe2e0f61b85b90de6642
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is an encrypted and malformed Office document, which is a common tactic to evade static analysis and hide malicious payloads. The encryption and structural corruption suggest an attempt to conceal the true nature of the file, likely as part of a phishing campaign.

Heuristics 2

  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).

Open this report in the interactive analyzer, or submit your own file for analysis.