Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 7cb93aff82a43b41…

MALICIOUS

Office (OLE) / .DOC

251.1 KB Created: 2007-12-03 01:19:00 Authoring application: Microsoft Word 9.0
MD5: 83df74eefb30463404ba90b7dde2564f SHA-1: f09f4803f5089ae3b87e7f6422dbf256413317d7 SHA-256: 7cb93aff82a43b41fbd7105b2644e04f2272f7d06d2aea8d5637b2a7d786b0c0
400 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Word document with a significant amount of slack space and an embedded PE executable. Heuristics indicate the use of WinExec, CreateProcess, ShellExecute, LoadLibrary, and GetProcAddress APIs, along with XOR-encoded strings and a NOP sled, suggesting the embedded executable is designed to be run. The embedded executable is the primary IOC. The document body is heavily corrupted and does not provide further context.

Heuristics 10

  • XOR-encoded strings (key 0x31) critical SC_XOR_ENCODED
    Found 6 Windows library/API name(s) XOR-encoded with single-byte key 0x31: 'msvcrt.dll', 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateThread'
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 257,118 bytes but its declared streams total only 16,486 bytes — 240,632 bytes (94%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://co.clickandpledge.com/advanced/default.aspx?wid=23093
    • http://www.ird.org/what/stories/haiti_earthquake.html
    • http://www.redcross.org/
    • http://www.usnews.com/money/personal-finance/articles/2010/01/14/10-ways-you-can-donate-to-haitian-earthquake-victims.html
    • http://doctorswithoutborders.org/
    • http://www.care.org/emergency/haitiearthquake/index.asp
    • http://www.pih.org/inforesources/news/Haiti_Earthquake.html
    • http://www.worldvision.org/
    • https://secure.unicefusa.org/site/Donation2?df_id=6680&6680.donation=form1
    • https://secure.oxfamamerica.org/site/Donation2?df_id=3560&3560.donation=form1
    • https://secure20.salvationarmy.org/pages/makeDonation/usa/makeDonation.jsf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00004c00.exe
25fd6b3fb242519f3ea3a6f52cd56baddb5dcd8dcebe8277b418ce2c2aea7f0e		 embedded-pe Office MZ+PE at offset 0x4C00 237662 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.