Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 7fe56eb4c95a7396…

MALICIOUS

Office (OLE) / .DOC

82.0 KB Created: 2009-03-23 02:20:00 Authoring application: Microsoft Office Word
MD5: 0fb1975a10df755a1043ebb1ce719832 SHA-1: 0e8b4ad60b7d031826a351350d2f840fdc3e514c SHA-256: 7fe56eb4c95a739634f43de1f3b9d838154ec58d0232a3fb1b8d93d6ea7e3226
140 Risk Score

Malware Insights

MITRE ATT&CK
T1027 Obfuscated Files or Information

The sample exhibits characteristics of a malicious document, including XOR-encoded strings and a significant amount of slack space within the OLE structure, which are common evasion techniques. While no specific payload or delivery mechanism is directly evident from the limited static analysis, these indicators strongly suggest an intent to conceal malicious activity. The GetPC stub further points to code intended for execution.

Heuristics 3

  • XOR-encoded strings (key 0x63) critical SC_XOR_ENCODED
    Found 3 Windows library/API name(s) XOR-encoded with single-byte key 0x63: 'CreateProcessA', 'ExitProcess', 'CreateFileA'
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 83,969 bytes but its declared streams total only 20,639 bytes — 63,330 bytes (75%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.