Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 caf6911acae50abc…

MALICIOUS

Office (OLE)

38.4 KB First seen: 2019-05-31
MD5: 277f0969a86f1f79b2d38b9b1a4e77f1 SHA-1: 0db3789b84d6df42c5106f110d1b93995246cce8 SHA-256: caf6911acae50abcabe248286d519adcf283372b7780b067b34ae4e3889c04d6
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is an encrypted and malformed Office document, which is a common tactic to evade static analysis and hide malicious payloads. The encryption and structural corruption suggest an attempt to conceal the true nature of the file, likely as part of a phishing campaign.

Heuristics 2

  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).

Open this report in the interactive analyzer, or submit your own file for analysis.