Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c7008f0c98bfebee…

MALICIOUS

Office (OLE)

559.0 KB Created: 2008-03-05 03:19:00 Authoring application: Microsoft Office Word
MD5: 85d75803c95f7631154e0fb49c5b5739 SHA-1: c268cbca2172760eb4046cae3465b5f362fca441 SHA-256: c7008f0c98bfebeeb972a8ab312e45b21ce1576fc2404db3ee22a85c86f9d39d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1027 Obfuscated Files or Information

The sample exhibits characteristics of a malicious document, specifically the presence of XOR-encoded strings and a significant amount of slack space within the OLE structure. These techniques are commonly used to obfuscate malicious payloads. No document body or scripts were extracted, limiting further analysis of the specific payload or delivery mechanism. The confidence is moderate due to the lack of direct payload indicators.

Heuristics 2

  • XOR-encoded strings (key 0x63) critical SC_XOR_ENCODED
    Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0x63: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess', 'CreateFileA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 572,416 bytes but its declared streams total only 20,635 bytes — 551,781 bytes (96%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.