Office (OLE) malware analysis — malicious · 978ebca7e5d6f2cc

MALICIOUS

Office (OLE)

99.0 KB

MD5: 146e2747ad38650fa0c40321ad3487fa SHA-1: a73d15fe3675e1e0fb7b1bee7b3def2803d2416a SHA-256: 978ebca7e5d6f2cca1a30cfcec0ef6956723168367ed8fb68cc37be37568200e

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059 Command and Scripting Interpreter

The file is an OLE document with a significant slack space anomaly, indicating it might be packed or contain hidden data. A heuristic firing for CreateProcess API suggests the potential execution of external processes. The document body contains references to embedded Office objects (Excel, PowerPoint), which could be used to deliver malicious payloads. However, no specific IOCs like URLs or hashes were extracted, and the exact nature of the payload remains unclear.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 101,376 bytes but its declared streams total only 31,351 bytes — 70,025 bytes (69%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.