Office (OLE) malware analysis — malicious · b682603c343e133f

MALICIOUS

Office (OLE)

396.1 KB

MD5: 4d3bc15c0aebc770f8bbf67c24f93b9a SHA-1: 67f2fe64350a50e3c55681e9c25a7f4db16efbc6 SHA-256: b682603c343e133f2479233ab64ab7cc9dda11e2a75fd3f1ab01e41187f1e6b7

298 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 Malicious Link: Malicious File T1071.001 Application Layer Protocol: Web Protocols T1566.002 Phishing: Spearphishing Attachment

The file is identified as a malicious PDF (Pdf.Dropper.Agent-7216722-0) due to critical heuristic firings related to XFA forms, heap spraying, and embedded JavaScript payloads. The embedded JavaScript, stream_000_off00000049.js, is highly suspicious and likely responsible for executing the exploit. The polyglot nature of the file, embedding a PDF within an OLE structure, further indicates a deliberate attempt to evade detection and deliver a malicious payload.

Heuristics 9

XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT

PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE

A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY

PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
ClamAV: Pdf.Dropper.Agent-7216722-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7216722-0
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 405,564 bytes but its declared streams total only 0 bytes — 405,564 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD

PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
XFA form low PDF_XFA

PDF uses XML Forms Architecture — can contain script logic
String.fromCharCode low PDF_FROMCHARCODE

String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_000_off00000049.js` `0372351f0cb4c23e2ed02ac76db367f727b4464fc4d8fed4166853716cbd9c4f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x49	4194304 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s).
`polyglot_child_pdf_off000003e8.pdf` `c07267ff0e3d5fbdac329ed0126721e848d8ae94211f2f8e7d33369d1bb5d6d6`	polyglot-child-pdf	Secondary PDF body inside ole container at offset 0x3E8	404564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.