Office (OLE) / .DOC malware analysis — malicious · 88a2a6fd4d00cc59

MALICIOUS

Office (OLE) / .DOC

174.5 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0

MD5: 6ab043ecb08fa92c0e948c91f1c78cb1 SHA-1: fa0d1674620c0b6dd889dba1fc6c3923878eefdb SHA-256: 88a2a6fd4d00cc59f2e8f88149dfb3b037a994f126634bcc2219f2e7d93a6655

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1059.001 PowerShell T1204.002 Malicious File T1055 Process Injection

The sample exhibits high-confidence heuristic firings for WinExec, CreateProcess, cmd.exe invocation, LoadLibrary, and GetProcAddress, indicating a strong likelihood of code execution and dynamic library loading. The OLE slack anomaly suggests potential obfuscation or padding within the document structure. While no specific URLs or scripts were extracted, the combination of API calls points towards a downloader or dropper functionality.

Heuristics 7

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Suspicious cmd.exe invocation with execution flag high SC_STR_CMD

Suspicious cmd.exe invocation with execution flag
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 178,688 bytes but its declared streams total only 94,801 bytes — 83,887 bytes (47%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.