Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 609ab0dfa3575363…

MALICIOUS

Office (OLE)

396.0 KB
MD5: 039b91a78d5d3cc7792bdcda77017917 SHA-1: 8cfd64587c2fb74e61a66feaaea8cdf9d54253b8 SHA-256: 609ab0dfa3575363a89babca089145f0f678b799457ee4ff14033fe18f400e71
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is a polyglot file containing an embedded PDF with XFA and JavaScript. Static analysis indicates the JavaScript is used for a heap spray exploit, likely to download and execute a second-stage payload. The embedded PDF structure and the presence of JavaScript point towards exploitation of a client execution vulnerability, commonly delivered via spearphishing attachments.

Heuristics 10

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY
    PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 405,502 bytes but its declared streams total only 0 bytes — 405,502 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Embedded script payload in PDF stream low PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/3.1/
    • http://www.xfa.org/schema/xfa-template/3.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off00000049.js
0372351f0cb4c23e2ed02ac76db367f727b4464fc4d8fed4166853716cbd9c4f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49 4194304 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
polyglot_child_pdf_off000003e8.pdf
135b8e8d3aa8220b9b3b3482e8c29cd93aeaffe91e7c010b8bdabd58f105b09c		 polyglot-child-pdf Secondary PDF body inside ole container at offset 0x3E8 404502 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.