Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 ba860f5726bdd933…

MALICIOUS

Office (OLE) / .DOC

82.3 KB Created: 2006-05-31 18:27:00 Authoring application: Microsoft Word 10.0
MD5: df3f4f46094806ef61ca47940485a570 SHA-1: ab653aaa486021592aafc0230557b6d3781e5454 SHA-256: ba860f5726bdd933b08172adf3d7cd926822d7843b3312bb2fc12b84920b4496
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1027 Obfuscated Files or Information

The sample exhibits characteristics of malicious documents, including a NOP sled and XOR-encoded strings, indicating an attempt to hide malicious code. The OLE document structure shows a significant amount of slack space, often used for embedding malicious content. Although VBA macros could not be extracted due to an unsupported format, the presence of embedded URLs and the overall heuristic firings strongly suggest that this document is designed to download and execute a second-stage payload.

Heuristics 4

  • XOR-encoded strings (key 0xE5) critical SC_XOR_ENCODED
    Found 5 Windows library/API name(s) XOR-encoded with single-byte key 0xE5: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualProtect', 'ExitProcess'
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 84,252 bytes but its declared streams total only 18,337 bytes — 65,915 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.