Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 81f9057431b7b3c6…

MALICIOUS

Office (OLE)

396.1 KB
MD5: 2855ae05835e03985ce27753d053f2e6 SHA-1: 78c0a42ee4e72d7bf6cc71097a3cf3e62780e4bb SHA-256: 81f9057431b7b3c60e843771d997a7f02c484ec2b4a6777a370b15a008436fad
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is identified as a malicious PDF dropper by ClamAV and exhibits critical heuristic findings related to XFA forms and embedded JavaScript heap spray exploit code. The embedded JavaScript, identified as stream_000_off00000049.js, is the primary mechanism for exploitation. This suggests the document is designed to exploit vulnerabilities via the embedded script, likely to download and execute further malicious content.

Heuristics 11

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY
    PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
  • ClamAV: Pdf.Dropper.Agent-7277617-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7277617-0
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 405,562 bytes but its declared streams total only 0 bytes — 405,562 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Embedded script payload in PDF stream low PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xdp/
    • http://www.xfa.org/schema/xfa-template/3.1/
    • http://www.xfa.org/schema/xfa-template/3.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off00000049.js
0372351f0cb4c23e2ed02ac76db367f727b4464fc4d8fed4166853716cbd9c4f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49 4194304 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
polyglot_child_pdf_off000003e8.pdf
6619449263180bc513c658ecf051476efb9d9790002c3e44387cc475b4121ed5		 polyglot-child-pdf Secondary PDF body inside ole container at offset 0x3E8 404562 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.