Malicious Office (OLE) / .D — malware analysis report

Static analysis result for SHA-256 92a528b9a44e1225…

MALICIOUS

Office (OLE) / .D

127.8 KB
MD5: 7cc6827cd831bb6e341de64f04e1de38 SHA-1: 4708d48d5c0ab3420c63a86879b33040c21c0609 SHA-256: 92a528b9a44e12257ba0b8ddb7239be3b9afc8a0ca557caeadaef7bab1469350
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1204.002 Malicious File T1055 Process Injection

The sample exhibits high-confidence heuristic firings for WinExec, CreateProcess, LoadLibrary, and GetProcAddress, indicating dynamic code execution capabilities. A suspicious cmd.exe invocation with an execution flag was also detected. The OLE slack anomaly suggests potential obfuscation or padding within the document structure. While an embedded URL was found, it was confirmed as benign, and no scripts were extracted. The combination of API calls strongly suggests the document is designed to execute arbitrary code, likely a downloader.

Heuristics 8

  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 130,855 bytes but its declared streams total only 31,351 bytes — 99,504 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hrw.org/europecentral-asia/kyrgyzstan\par