Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 8b218e5ab23d3ef9…

MALICIOUS

Office (OLE) / .DOC

92.8 KB Created: 2007-11-03 09:34:00 Authoring application: Microsoft Office Word
MD5: a3171fe2bb044187db1222aa62ba29f8 SHA-1: 07b76a8470f2fa20d715510eab9f353f7997a5af SHA-256: 8b218e5ab23d3ef9eea013183113f4f622ac15d003b63ce1604604a2a2abba28
100 Risk Score

Malware Insights

MITRE ATT&CK
T1027 Obfuscated Files or Information

The sample exhibits a critical heuristic for XOR-encoded strings with a key of 0x6D, indicating intentional obfuscation. Additionally, a high heuristic firing for OLE slack anomaly reveals that a significant portion (78%) of the file is unaccounted for, further supporting the presence of hidden malicious content. No document body or scripts were extracted, limiting the ability to determine the specific payload or delivery mechanism.

Heuristics 2

  • XOR-encoded strings (key 0x6D) critical SC_XOR_ENCODED
    Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0x6D: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess', 'CreateFileA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 94,992 bytes but its declared streams total only 20,639 bytes — 74,353 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.