Office (OLE) malware analysis — malicious · a3b47316669721a1

MALICIOUS

Office (OLE)

89.8 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 0842bf7f2082ec88a63fc932654b2d3c SHA-1: d22aaeecea6ad58eac50241507a39621feabe012 SHA-256: a3b47316669721a1a72835a29b6404f7a6e532a463bb56df6ef754a421942db0

360 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1055 Process Injection

The sample exhibits strong indicators of malicious activity, including references to critical Windows API functions such as WriteProcessMemory, CreateRemoteThread, LoadLibrary, and GetProcAddress. These functions are commonly used for process injection, a technique to execute arbitrary code within another process. The presence of OLE Slack Anomaly also suggests potential obfuscation or padding within the document structure. While no specific family is identified, the techniques point towards a downloader or dropper mechanism.

Heuristics 9

Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 91,930 bytes but its declared streams total only 21,151 bytes — 70,779 bytes (77%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.