Office (OLE) / .DOC malware analysis — malicious · 9a4b0ad10603b950

MALICIOUS

Office (OLE) / .DOC

876.0 KB Created: 2012-09-21 09:56:09 Authoring application: Windows Installer

MD5: 2ca0ab311e12c1ef49ea89d47a22ba53 SHA-1: 893e83ac8603a95c1f4bd921b4b9919ae967d004 SHA-256: 9a4b0ad10603b950348f1e8d536ab8ea86927a2475bc0d3d6d378c41f745e728

300 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1059.003 Windows Command Shell T1204.002 Malicious File

The sample is a malicious Office document containing an embedded PE executable. Heuristics indicate the use of Windows API functions such as CreateProcess, ShellExecute, VirtualAlloc, WriteProcessMemory, LoadLibrary, and GetProcAddress, suggesting the embedded executable is likely unpacked or executed. The presence of an embedded executable is a strong indicator of a malicious payload delivery.

Heuristics 7

Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00006000.exe` `de80251e42675c59adc405a8854919161d3056af5a01c7c3296e2c8767f8553f`	embedded-pe	Office MZ+PE at offset 0x6000	872448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.