Malicious Microsoft Write / .WRI — malware analysis report

Static analysis result for SHA-256 7c66462e3c7b0c46…

MALICIOUS

Microsoft Write / .WRI

172.5 KB Created: 2008-10-09 03:10:00 Authoring application: Microsoft Word 9.0
MD5: 91c680234da9b7bc829894be0e0e07d9 SHA-1: 4c1e7e9ebfc28cb96d86a3acde7b51543bb35f5f SHA-256: 7c66462e3c7b0c4679a8082d97a11dd5aee3ef8755b71872f6f1721868f3187b
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is a Microsoft Write document containing an embedded OLE object that exhibits suspicious static findings, including large slack space and an appended executable payload. Heuristics indicate the presence of NOP sleds and a GetPC stub, suggesting shellcode execution. The embedded URL, though localhost, is suspicious in this context.

Heuristics 8

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 176,649 bytes but its declared streams total only 79,383 bytes — 97,266 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED
    Long run of 0x61 bytes
  • OLE-wrapped Microsoft Write document (Write for Windows 95) info WRI_OLE_WRAPPED
    File is a Write-for-Windows-95 document — an OLE compound document carrying Write streams. Embedded objects (Equation Editor, OLE Package) inside this container exercise the same exploit surface as classic Office documents.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhost

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00000000.ole
7c66462e3c7b0c4679a8082d97a11dd5aee3ef8755b71872f6f1721868f3187b		 embedded-office Embedded OLE/CFB Office body inside wri container at offset 0x0 176649 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.