Malicious Office (OLE) / .DO — malware analysis report

Static analysis result for SHA-256 6f731c7a5660d65f…

MALICIOUS

Office (OLE) / .DO

137.6 KB Created: 2008-04-23 12:48:44 Authoring application: Microsoft Office Word
MD5: fd661c43d9cd773c2af67d553b1f6271 SHA-1: e8d48605fe4c0eee9cd9d50f6050e00681dc5679 SHA-256: 6f731c7a5660d65f54c02b08de09e84380b95dcfca62a9652a1e56e03dae9fc3
240 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as a malicious Office document with significant slack space and an appended payload, indicating it's likely a dropper. Heuristics related to LoadLibrary and GetProcAddress APIs suggest the execution of external code. The presence of embedded OLE objects for PowerPoint and Excel further supports its role as a malicious document.

Heuristics 6

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 140,870 bytes but its declared streams total only 40,506 bytes — 100,364 bytes (71%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.