Office (OLE) / .DOC malware analysis — malicious · 64486f86c1e94798

MALICIOUS

Office (OLE) / .DOC

141.5 KB Created: 2007-09-18 04:34:00 Authoring application: Microsoft Word 11.

MD5: 0a801b2d4bff976e1fa9bef4930107f6 SHA-1: c163479df231c79b6148e15bee862b8e59399511 SHA-256: 64486f86c1e94798c7b3c2909790c8875385f8023d522c737f7ca301256aadb3

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is a malicious OLE document exhibiting a large slack space anomaly and XOR-encoded strings, indicating obfuscation. The presence of these indicators suggests an attempt to exploit a vulnerability within Microsoft Word for code execution, likely to download and run a secondary payload.

Heuristics 2

XOR-encoded strings (key 0xFC) critical SC_XOR_ENCODED

Found 5 Windows library/API name(s) XOR-encoded with single-byte key 0xFC: 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateProcessA', 'RegOpenKeyExA'
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 144,896 bytes but its declared streams total only 16,486 bytes — 128,410 bytes (89%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.