Office (OLE) malware analysis — malicious · a146c539b5767358

MALICIOUS

Office (OLE)

106.9 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 33ffdf700ed716dc0bc7214b646c2411 SHA-1: 058c223e6952bce3cd16cb3ccfc529c13d2a1434 SHA-256: a146c539b576735891c7d2a83ade54091ada3162f361b64616b2c1f0f74813c8

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The OLE document exhibits a significant slack space anomaly, indicating potential obfuscation or hidden content. Furthermore, the presence of references to WinExec, LoadLibrary, and GetProcAddress API functions strongly suggests that the document is designed to execute arbitrary code. The exact nature of the payload could not be determined due to the lack of a document body or script content.

Heuristics 4

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 109,472 bytes but its declared streams total only 21,151 bytes — 88,321 bytes (81%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.