Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 693f75bcc7af13ca…

MALICIOUS

Office (OLE) / .DOC

181.0 KB
MD5: d0ef05f9ad892667d6b676f2bcfc655b SHA-1: 7c37c6ec2a6f35175d9c734f4dc6f01fe9390d86 SHA-256: 693f75bcc7af13ca396b7bba977dd12d1dedf5b84a2815dae208617d66fb7497
260 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter

The sample exhibits high-severity heuristic firings indicating the use of CreateProcess, ShellExecute, VirtualAlloc, LoadLibrary, and GetProcAddress APIs, suggesting an attempt to execute arbitrary code. The OLE document structure also shows anomalies and contains an EMF object, further supporting a malicious intent. While no explicit script was extracted, the API calls strongly imply the execution of a payload, likely involving dynamic library loading and process manipulation.

Heuristics 7

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 185,344 bytes but its declared streams total only 31,351 bytes — 153,993 bytes (83%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API