Office (OLE) / .DOC malware analysis — malicious · 8b59e24ce0245c44

MALICIOUS

Office (OLE) / .DOC

136.2 KB Created: 2007-09-18 04:34:00 Authoring application: Microsoft Word 11.

MD5: ad681ff97acfc423fbd2f542364dbd72 SHA-1: ca771901022781d13ee8b04c86339214216ebc49 SHA-256: 8b59e24ce0245c440d1b4c38976871bbf559c74fc9ff7d018e358b7359069574

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious OLE document with a large slack space anomaly, indicating potential obfuscation or embedded malicious content. The PEB access heuristic suggests an attempt to evade detection or manipulate process information. The document body contains VBA-like functions that appear to be constructing registry paths and filenames, likely for persistence or payload staging. Specifically, it constructs registry paths such as 'HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\3' and 'HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\3.doc', which are then likely used to establish persistence or store downloaded payloads.

Heuristics 2

PEB access via FS segment (x86) high SC_PEB_ACCESS

PEB access via FS segment (x86)
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 139,504 bytes but its declared streams total only 16,486 bytes — 123,018 bytes (88%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.