Office (OLE) / .DOC malware analysis — malicious · 948a3c9afe97159d

MALICIOUS

Office (OLE) / .DOC

61.2 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 78794c3a77de352a53b970c2e2fe82f0 SHA-1: f73a281598ef67836002c086ab12926389c97ed4 SHA-256: 948a3c9afe97159dfa4c85f63b3f430f3ef26784c0639e25059bf10c09f5ada8

80 Risk Score

Malware Insights

The sample is a malicious OLE document that contains a reference to the CreateProcess API, indicating an attempt to launch an external process. The document body is filled with unreadable characters, and no scripts were extracted. The large slack space in the OLE structure is also suspicious. Without further script or URL indicators, the exact nature of the payload remains unclear, but the CreateProcess call suggests a downloader or dropper.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 62,624 bytes but its declared streams total only 21,151 bytes — 41,473 bytes (66%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.