Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 d68f2b69f5280ce4…

MALICIOUS

Office (OLE) / .DOC

129.2 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: 1b8c6dfa8196bb05d53f2bb85e0d1488 SHA-1: ef844c0c6b5c01cc9f70bada29d7408da1e2c68c SHA-256: d68f2b69f5280ce4680fdc9340b857adec811566172d9a69e96995c03049ef90
202 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The sample is a malicious Microsoft Word document exploiting CVE-2006-6456, a vulnerability related to malformed tables. Heuristics indicate PEB access and XOR-encoded strings, suggesting an attempt to obfuscate malicious code execution. No VBA macros were extractable, but the exploit itself is sufficient to indicate malicious intent. The document body is heavily corrupted and unreadable, providing no further context.

Heuristics 5

  • CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456
    WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
  • XOR-encoded strings (key 0xAB) critical SC_XOR_ENCODED
    Found 3 Windows library/API name(s) XOR-encoded with single-byte key 0xAB: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress'
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.