Malicious Office (OLE) / .D — malware analysis report

Static analysis result for SHA-256 7589fe7e1a625eb8…

MALICIOUS

Office (OLE) / .D

130.4 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word
MD5: 6b49e2a456d8c4321d4d586a4f32f0f3 SHA-1: e82de48e6c19027ada65235c629daf04db230a09 SHA-256: 7589fe7e1a625eb8c863f45ecf7ede9a956ab50986f2e62bab9c26bdf976bf41
322 Risk Score

Malware Insights

MITRE ATT&CK
T1055 Process Injection T1055.012 Process Hollowing

The sample is a malicious OLE document exhibiting significant slack space, indicative of obfuscation. Critical heuristics indicate the use of WriteProcessMemory and CreateRemoteThread, strongly suggesting process injection. LoadLibrary and GetProcAddress further support the loading of external code. While no specific VBA or script content was extracted, the API calls point towards a dropper or loader functionality.

Heuristics 9

  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 133,536 bytes but its declared streams total only 21,151 bytes — 112,385 bytes (84%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.