Office (OLE) / .DOC malware analysis — malicious · cd54664c2d97121f

MALICIOUS

Office (OLE) / .DOC

141.5 KB

MD5: 73ae9872e82bb055dfceea9edd4bb9f8 SHA-1: de6e294497506e8ac0d7c8163bd42ac408f5722d SHA-256: cd54664c2d97121f9f98782be80978a1b940f1d20ca1734a97288449ac515af9

140 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The presence of OLE_SLACK_ANOMALY and references to VirtualAlloc, LoadLibrary, and GetProcAddress APIs suggest the document is designed to load and execute shellcode. The embedded URL http://www.truexinjiang.com/ is the most suspicious IOC. While no scripts were explicitly extracted, the heuristics strongly indicate a malicious OLE document attempting to download and run a secondary payload.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 144,896 bytes but its declared streams total only 31,351 bytes — 113,545 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.truexinjiang.com/
- http://encomment.huanqiu.com/content_comment.php?tid=447456&mid=1&cid=43
- http://opinion.globaltimes.cn/commentary/2009-07/attachment/090716/cc465e3d61.jpg
- http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.