Office (OLE) malware analysis — malicious · 887306a9609a9429

MALICIOUS

Office (OLE)

58.4 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 55a06ca718452f4e51e0a65d89389fde SHA-1: 9299532f3094ccf9e6cf68235ae65145d672e1d3 SHA-256: 887306a9609a94295374367213601d93ed9272dea8b8bbaf9a2da51fe6ca2b74

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The sample exhibits a high-severity heuristic firing for CreateProcess API usage, indicating an attempt to launch an external process. The OLE document structure also shows a significant slack space anomaly, which can sometimes be used to hide malicious code. Without a document body or script content, the exact nature of the payload is unclear, but the CreateProcess call is a strong indicator of malicious intent.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 59,808 bytes but its declared streams total only 21,151 bytes — 38,657 bytes (65%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.