Malicious Office (OLE) — malware analysis report

Heuristics 22

• CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244
  Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
• OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
  Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
• ClamAV: Doc.Macro.ObfuscatedChr-6203136-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Macro.ObfuscatedChr-6203136-0
• Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
  Reference to WriteProcessMemory API
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• VBA macros detected medium 7 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  Dim hhf As Variant
  hhf = Shell(uyt, 0)
  End Function

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  HUIQWD = "1k2lj 3l12jk12" & "k1j2jkh3123"
  Set meLaTure = CreateObject("W" & "" & "or" & "d." & "Applicatio" & BHJASD)
  HUIQWD = "1k2lj 3l12jk12" & "k1j2jkh3123"

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Customizable = True
  Sub AutoOpen()
      VBJHQWD = "12kj12vhg12" & ";12[]1l '1"

• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  End Sub
  Sub Workbook_Open()
      GhbGGbv

• Auto_Open macro low OLE_VBA_AUTO
  Auto_Open macro
  Matched line in script

  End Function
  Sub Auto_Open()
      Lashature

• Environ() call (env variable access) low OLE_VBA_ENVIRON
  Environ() call (env variable access)
  Matched line in script

  TTGDFW = FygGr(3 + 90 + sts)
  DBDDW = Environ(TYGE) + TTGDFW
  JIEKR = "." & "tmp" & ""

• PEB access via FS segment (x86) high SC_PEB_ACCESS
  PEB access via FS segment (x86)
  Disassembly

  Attempted x86 opcode disassembly

  00006C59  648b5230          mov edx, dword ptr fs:[edx + 0x30]
  00006C5D  2006              and byte ptr [esi], al
  00006C5F  0c79              or al, 0x79
  00006C61  1401              adc al, 1
  00006C63  7228              jb 0x6c8d
  00006C65  6a18              push 0x18
  00006C67  59                pop ecx
  00006C68  33ff              xor edi, edi
  00006C6A  c8c0ac00          enter -0x5340, 0
  00006C6E  3c61              cmp al, 0x61
  00006C70  7c02              jl 0x6c74
  00006C72  2c20              sub al, 0x20
  00006C74  c1cf00            ror edi, 0
  00006C77  0d03f8e2f0        or eax, 0xf0e2f803
  00006C7C  81ff5b03bc4a      cmp edi, 0x4abc035b
  00006C82  6a8b              push -0x75
  00006C84  5a                pop edx
  00006C85  10981275dbee      adc byte ptr [eax - 0x11248aee], bl
  00006C8B  c3                ret
  00006C8C  058944241c        add eax, 0x1c244489
  00006C91  61                popal
  00006C92  234455f0          and eax, dword ptr [ebp + edx*2 - 0x10]
  00006C96  ec                in al, dx
  00006C97  51                push ecx
  00006C98  53                push ebx
  00006C99  1d565760cf        sbb eax, 0xcf605756
  00006C9E  7508              jne 0x6ca8
  00006CA0  46                inc esi
  00006CA1  7d0c              jge 0x6caf
  00006CA3  9a3dc94937d17c    lcall 0x7cd1, 0x3749c93d
  00006CAA  70db              jo 0x6c87
  00006CAC  ac                lodsb al, byte ptr [esi]
  00006CAD  32c1              xor al, cl
  00006CAF  398acd3aea01      cmp dword ptr [edx + 0x1ea3acd], ecx
  00006CB5  d6                salc
  00006CB6  b608              mov dh, 8
  00006CB8  66                .byte 0x66

• Reference to CreateProcess API high SC_STR_CREATEPROCESS
  Reference to CreateProcess API
• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
  Reference to GetProcAddress API
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 170,496 bytes but its declared streams total only 43,787 bytes — 126,709 bytes (74%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
  Reference to VirtualAlloc API
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://hadfanawass.com/sl/gate.php|http://rophenreswi.ru/sl/gate.php|http://mihesfitons.ru/sl/gate.� In document text (OLE body)

  • https://krrewiaog3u4npcg.onion.to/sl/gate.phpIn document text (OLE body)
  • http://api.ipify.orgIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.