Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 83dd1d190a208190…

MALICIOUS

Office (OLE) / .DOC

149.0 KB
MD5: a0388374bed9a64b89f1d4788d0c410d SHA-1: 506174b2cc76c3823c66fa6c944b12fe8c2eefd7 SHA-256: 83dd1d190a208190a33030b2e0317de2507715fb6b9fbf7220f8592cd19e3939
220 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a callback phishing or tech-support scam, as indicated by the 'SE_CALLBACK_LURE' heuristic firing. The document body, though in Chinese, appears to be test data or internal notes rather than a user-facing lure. However, the presence of LoadLibrary and GetProcAddress API calls suggests the document likely contains or drops a malicious payload, potentially exploiting vulnerabilities or executing arbitrary code.

Heuristics 6

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 152,580 bytes but its declared streams total only 31,351 bytes — 121,229 bytes (79%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.