Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 99c03d1e8b21623d…

MALICIOUS

Office (OLE)

27.0 KB Created: 1999-06-09 09:43:00 Authoring application: Microsoft Word 6.0 First seen: 2012-10-03
MD5: 3a4a6801b91210fa8fd29efdb4d96f95 SHA-1: 60b82183f5ae534dd4935da48069a1fa11d98e0f SHA-256: 99c03d1e8b21623dc70d9f71b679edcc73b148ad259a2866a301c8b8bc7e24f3
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an OLE file containing legacy WordBasic macro virus markers and suspicious OLE structure anomalies, indicating it is designed to execute malicious code. The document body presents as a laboratory analysis report, likely a lure to trick the user into interacting with the embedded malicious OLE object. The presence of embedded OLE objects and macro virus markers strongly suggests an attempt to exploit the user via a malicious attachment.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. OLE file is 23,192 bytes but its declared streams total only 0 bytes — 23,192 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00001168.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x1168 23192 bytes
SHA-256: b58296c7138428cc4b30645f8c2302f96e3ab3e512173faec8b89f18c59f649b
embedded_office_off00001f3b.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x1F3B 19653 bytes
SHA-256: 29f8ac96b340830092f6bc08ef1e1645a6ed372fb697951a00d693786da2e303

Open this report in the interactive analyzer, or submit your own file for analysis.