Office (OLE) malware analysis — malicious · 9f15c8f9a8567a98

MALICIOUS

Office (OLE)

228.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0

MD5: 6418dffd9548b69abf01aab00d8ae2e3 SHA-1: 411de0ad7ad60553a38ea3f54b82fc34ffd0556d SHA-256: 9f15c8f9a8567a98dd32c2bafe3a5115a8135cf0ca71588776df5ee747000f3e

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1059.003 Windows Command Shell

The sample exhibits high-confidence heuristic firings for CreateProcess, ShellExecute, LoadLibrary, and GetProcAddress, indicating attempts to execute code and load dynamic libraries. The OLE slack anomaly suggests potential obfuscation or padding. While no scripts were extracted, the API calls strongly suggest the document is designed to download and execute a second-stage payload.

Heuristics 7

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 233,472 bytes but its declared streams total only 94,801 bytes — 138,671 bytes (59%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.