Malicious Hangul (OLE) — malware analysis report

Static analysis result for SHA-256 9c876893d90ad2db…

MALICIOUS

Hangul (OLE)

10.03 MB First seen: 2015-06-09
MD5: 7dc4b7f0ef426cccbed3d8a72483b040 SHA-1: 87e932870f0521f592ac1102108108812004caa2 SHA-256: 9c876893d90ad2db4297cccd59a2c54c2c9d488b08888775d48846f9edf627c9
84 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The OLE document exhibits a large slack space and an appended executable payload, indicating the presence of a hidden malicious component. The embedded artifacts, including JPG files within HWP streams, suggest an attempt to conceal the executable payload. The file's structure and appended data strongly suggest it's designed to deliver a secondary stage payload upon opening.

Heuristics 4

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 10,518,528 bytes but its declared streams total only 5,411,242 bytes — 5,107,286 bytes (49%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Decompressed OLE-wrapped HWP streams info HWP_COMPRESSED
    Inflated 2583900 bytes from BinData / Scripts / BodyText / DocInfo streams of the OLE-wrapped HWP for content analysis
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.iec.ch In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/aux/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
BinData_BIN0001.jpg hwp-stream HWP OLE stream: BinData/BIN0001.jpg 2097152 bytes
SHA-256: e101f41e04a4f39ebec0df812407a740fdafad3ec108b31bd78dc6ab023e6cf9
BinData_BIN0002.jpg hwp-stream HWP OLE stream: BinData/BIN0002.jpg 109884 bytes
SHA-256: 79e8199c14b92b32c487da181c3ea9600daba86c59d60360304c6c01f2e4aa0e
BinData_BIN0003.jpg hwp-stream HWP OLE stream: BinData/BIN0003.jpg 183646 bytes
SHA-256: 4d9a81ecc01ee2709359b75fc616a719815a939ec4d86dd79e5c1cd228fe6493
BodyText_Section0 hwp-stream HWP OLE stream: BodyText/Section0 6040 bytes
SHA-256: edc6ef4ff9df7a0d405877d74621906df966892319a215ec5c9ea314835e51c1
DocInfo hwp-stream HWP OLE stream: DocInfo 3504 bytes
SHA-256: f1bbde798131ba5b70934b741ae057e11ca9916aeb668395b7a1866fbf6f3e0f

Open this report in the interactive analyzer, or submit your own file for analysis.