Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 c82227f70408b252…

MALICIOUS

Office (OLE) / .DOC

312.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: 822ed3c6176bcb90251d04b3abdc1a78 SHA-1: 2b3af0ed48addfc4446676972bff80445746b524 SHA-256: c82227f70408b2520d0d87fbaaed65916a70d3c11e3bc503919f5440d2e9e2f0
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1059.001 PowerShell T1218.010 System Binary Proxy Execution: Regsvr32

The sample exhibits high-confidence heuristics indicating the use of WinExec, CreateProcess, VirtualAlloc, LoadLibrary, and GetProcAddress APIs, suggesting dynamic code execution. Notably, it references cmd.exe with an execution flag and contains visible LOLBin command execution instructions. This points to an attack pattern where the document likely attempts to download and execute a second-stage payload using Windows command-line utilities.

Heuristics 8

  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 319,488 bytes but its declared streams total only 94,801 bytes — 224,687 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.