Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 7020b954ec8f9d2e…

MALICIOUS

Office (OLE) / .DOC

156.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: 6c3c40073f258777f035894baf582fa8 SHA-1: b9c77f81fb5bc8e4046189ead8ae7b6f2a18d5fe SHA-256: 7020b954ec8f9d2e5d50da269c2cf1ab670b9a1da8e023f87934f213122ab747
202 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document that exploits CVE-2006-6456, a vulnerability related to malformed table SPRM data. The presence of VirtualAlloc, LoadLibrary, and GetProcAddress API calls suggests the document attempts to allocate memory and load external code, likely to execute a payload. The large slack space anomaly further indicates potential obfuscation or embedded malicious content.

Heuristics 6

  • CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456
    WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 159,744 bytes but its declared streams total only 94,801 bytes — 64,943 bytes (41%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main