Office (OLE) / .DOC malware analysis — malicious · b8e9d62c9b827ebd

MALICIOUS

Office (OLE) / .DOC

1.56 MB First seen: 2022-06-03

MD5: 99bcd23fe26def3369e5cc4f7665b8fc SHA-1: 653ebcc428e855200823b42d9dd2f5ba2c74d102 SHA-256: b8e9d62c9b827ebdbcf1f7e6d15f9155c0a81ac73960839ac7c3b5e420f26ef8

82 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking

The presence of an Equation Editor OLE object strongly indicates the use of an exploit targeting this component. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests a social engineering tactic where the document instructs the user to open a password-protected archive, likely containing the next stage of the attack. No scripts were extracted from this sample.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `6657615166004dbff8a53887fcc7da8b118248f377044296d9188a04503b1e5d`	ole-package	OLE Ole10Native stream: oLE10NatIVE	1620152 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.