Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 788f1abb67d6f21c…

MALICIOUS

Office (OLE) / .DOC

967.8 KB Created: 2010-03-30 17:08:46 Authoring application: Windows Installer XML (3.0.5419.0)
MD5: e435c7fe014ceb78e4bc09bf3f71c5d0 SHA-1: d895c75ea47413b96df4673e929cb55dab912306 SHA-256: 788f1abb67d6f21cf299e2f67a2b414d169e8ab16cc8a61bf698e5c7f1482999
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing an embedded PE executable. Heuristics indicate the presence of APIs commonly used for loading and executing code, such as VirtualAlloc, LoadLibrary, and GetProcAddress. The embedded executable is the primary indicator of malicious intent, suggesting a delivery mechanism for a secondary payload.

Heuristics 6

  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H
    • http://www.microsoft.com/pki/certs/CSPCA.crt0
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0H
    • http://www.microsoft.com/pki/certs/tspca.crt0
    • http://office.microsoft.com
    • http://support.microsoft.com/?kbid=xxxxxxPSS10R.CHMERRORSUPPORTTEXT_RETAIL_DEFAULT_PROBLEM_PREIf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00002400.exe
05dc33815f31de4a8ae977bf738be71b6914c252ef6576b32a907b7e7ab05411		 embedded-pe Office MZ+PE at offset 0x2400 981767 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.