Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b9da673e305031a3…

MALICIOUS

Office (OLE)

612.9 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word
MD5: 2665f3d458957978ac4883f2acebf52e SHA-1: 5dd880e453d68cf98c59bbe3c859898fa4d7c9d7 SHA-256: b9da673e305031a3ffcb572b396fee04b2368cd31de5410ce7d52b78b3de007a
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The document exhibits characteristics of an advance-fee scam, using language related to lotteries, prizes, and parcel delivery to deceive the user. Heuristics indicate the potential use of CreateProcess, ShellExecute, VirtualAlloc, LoadLibrary, and GetProcAddress APIs, suggesting the file may download and execute additional payloads. No scripts were extracted from this sample.

Heuristics 8

  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 627,616 bytes but its declared streams total only 21,151 bytes — 606,465 bytes (97%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.idsa.in/idsacomments/IranandtheNPTRevCon2010_sscrajiv_040510
    • http://idsa.in/idsacomments/AdvantagesofincludingMunitionsItemsintheSCOMETList_gbalachandran_040510
    • http://www.sinodaily.com/reports/Taiwan_unveils_China_attack_response_999.html
    • http://www.spacewar.com/reports/NKorea_deploys_50000_special_forces_near_border_report_999.html
    • http://www.spacewar.com/reports/Iran_says_probe_needed_to_verify_US_warhead_claims_999.html
    • http://www.spacewar.com/reports/US_increasingly_skeptical_about_dialogue_with_Iran_999.html
    • http://www.spacewar.com/reports/New_UN_sanctions_would_doom_better_US-Iran_ties_Ahmadinejad_999.html
    • http://www.spacewar.com/reports/Egypt_US_eye_compromise_on_nuclear-free_Mideast_talks_999.html
    • http://www.spacewar.com/reports/Israel_seeks_US_aid_for_Iron_Dome_999.html
    • http://www.dailytimes.com.pk/default.asp?page=2010\\05\\05\\story_5-5-2010_pg3_2
    • http://www.dailytimes.com.pk/default.asp?page=2010\05\05\story_5-5-2010_pg3_2
    • http://www.dailytimes.com.pk/default.asp?page=2010\\05\\05\\story_5-5-2010_pg3_3
    • http://www.dailytimes.com.pk/default.asp?page=2010\05\05\story_5-5-2010_pg3_3
    • http://www.dailytimes.com.pk/default.asp?page=2010\\05\\05\\story_5-5-2010_pg7_4
    • http://www.dailytimes.com.pk/default.asp?page=2010\05\05\story_5-5-2010_pg7_4
    • http://www.thefrontierpost.com/News.aspx?ncat=ar&nid=260
    • http://www.5iamas-microsoft-com:office:smarttags_
    • http://www.5iantlavalamp.com/V
    • http://www.5iantlavalamp.com/Z
    • http://www.5iantlavalamp.com/i
    • http://www.5iamas-microsoft-com:office:smarttags
    • http://www.atimes.com/atimes/Middle_East/LE05Ak03.html
    • http://www.atimes.com/atimes/China/LE05Ad01.html
    • http://www.atimes.com/atimes/Korea/LE05Dg01.html
    • http://www.atimes.com/atimes/Middle_East/LE05Ak02.html
    • http://www.khaleejtimes.com/displayarticle.asp?xfile=data/international/2010/May/international_May189.xml&section=international&col
    • http://en.rian.ru/russia/20100504/158871013.html
    • http://en.rian.ru/world/20100504/158871002.html
    • http://en.rian.ru/world/20100504/158870805.html
    • http://en.rian.ru/exsoviet/20100504/158869016.html
    • http://en.rian.ru/russia/20100504/158867108.html
    • http://en.rian.ru/world/20100504/158866608.html
    • http://en.rian.ru/russia/20100504/158865515.html
    • http://en.rian.ru/mlitary_news/20100504/158865302.html
    • http://www.washingtonpost.com/wp-dyn/content/article/2010/05/03/AR2010050304341.html?wpisrc=nl_headline
    • http://www.washingtonpost.com/wp-dyn/content/article/2010/05/03/AR2010050302089.html?wpisrc=nl_headline
    • http://www.time.com/time/world/article/0,8599,1986832,00.html?xid=newsletter-daily
    • http://www.jamestown.org/
    • http://gsn.nti.org/gsn/nw_20100504_6570.php
    • http://gsn.nti.org/gsn/nw_20100504_2346.php
    • http://www.un.org/disarmament/WMD/Nuclear/NPT2010Prepcom/PrepCom2009/statements/2009/04May2009/04May2009PMSpeaker-11-Iran-Edited.pdf
    • http://www.presstv.ir/detail.aspx?id=123659&sectionid=351020104
    • http://daccess-dds-ny.un.org/doc/UNDOC/GEN/G08/611/39/PDF/G0861139.pdf?OpenElement
    • http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N08/349/04/PDF/N0834904.pdf?OpenElement
    • http://daccess-dds-ny.un.org/doc/UNDOC/GEN/G08/610/74/PDF/G0861074.pdf?OpenElement
    • http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N09/328/41/PDF/N0932841.pdf?O
    • http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N09/336/21/PDF/N0933621.pdf?OpenElement
    • http://www.upi.com/Science_News/Resource-Wars/2010/05/04/OMV-finds-new-gas-in-Pakistan/UPI-34611272985324/
    • http://www.truthout.org/can-brazil-save-world-war-with-iran59157
    • http://www.truthout.org/demonizing-iran-media-beating-war-drums59155
    +12 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.