Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b9f121ac924a3695…

MALICIOUS

Office (OLE)

303.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: 7d98ce27931a7f7eb49ca22c7379be8f SHA-1: 821a8dd92be91f4b44e9b36147d81f227ba3d400 SHA-256: b9f121ac924a3695d0e760071550e788c90e39fa196c3fb76f9a3ed290ce57bc
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1027 Obfuscated Files or Information

The sample exhibits characteristics of a malicious document, including the presence of XOR-encoded strings and a reference to the WinExec API, indicating an attempt to execute code. The large slack space in the OLE structure is also anomalous. Without further script or URL analysis, the exact payload and delivery mechanism remain unclear, leading to an 'unknown family' classification.

Heuristics 3

  • XOR-encoded strings (key 0xDB) critical SC_XOR_ENCODED
    Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0xDB: 'iphlpapi.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA', 'WSAStartup', 'CreateThread', 'RegOpenKeyExA'
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 310,272 bytes but its declared streams total only 94,801 bytes — 215,471 bytes (69%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.