Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b2b67d074ead41f6…

MALICIOUS

Office (OLE)

136.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: 5b87852684cf096efac591bd693e4161 SHA-1: 2ff124fc897b3427b7d43ed64682ee2361ceeb64 SHA-256: b2b67d074ead41f63064d4fb607e7a30e52a3bdfd3aefbe9ddac3b9a50853761
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter T1204.002 Malicious File T1055 Process Injection

The file exhibits characteristics of a malicious OLE document, indicated by a large slack space anomaly and the presence of high-severity heuristics related to PEB access and the use of critical Windows API functions like CreateProcess, VirtualAlloc, LoadLibrary, and GetProcAddress. These API calls suggest the file is designed to load and execute a secondary payload. No document body or scripts were extracted, limiting further analysis of the specific lure or payload delivery mechanism.

Heuristics 6

  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 139,264 bytes but its declared streams total only 24,565 bytes — 114,699 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.