Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c480568982800df9…

MALICIOUS

Office (OLE)

174.0 KB
MD5: b1f2a3f32a69291832682ac18ad8aa7f SHA-1: 6a1558725ccf0de0a5aef33c8a831fbbb72490b5 SHA-256: c480568982800df91290f665f10abc3f2aec5e9c49f492115358d879b911f741
80 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1059 Command and Scripting Interpreter

The OLE document exhibits a large slack space anomaly, indicating potential obfuscation or embedded malicious content. The PEB access heuristic suggests an attempt to interact with the process environment, often used to bypass security controls or prepare for code execution. While no specific exploit is identified, these indicators point towards a malicious document likely designed to exploit a vulnerability and execute a payload.

Heuristics 2

  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 178,177 bytes but its declared streams total only 94,801 bytes — 83,376 bytes (47%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).