Office (OLE) / .DOC malware analysis — malicious · d6cc6b534bb45484

MALICIOUS

Office (OLE) / .DOC

168.5 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0

MD5: 4b366c04685fcb5f72c765e9417a7b53 SHA-1: 25081bd9b58986b03fe6d4d683811f9613d8af0e SHA-256: d6cc6b534bb4548461629ad21cc85016065f36d4b3002ee30d03f5474c36b255

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1059.001 PowerShell T1204.002 Malicious File T1055 Process Injection

The sample exhibits high-confidence heuristic firings indicating the use of WinExec, CreateProcess, LoadLibrary, and GetProcAddress APIs, strongly suggesting the execution of arbitrary code. The suspicious cmd.exe invocation further supports this. The OLE slack anomaly indicates potential obfuscation or padding within the document structure. No document body or script content was available for analysis, limiting the ability to determine the specific lure or payload.

Heuristics 7

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Suspicious cmd.exe invocation with execution flag high SC_STR_CMD

Suspicious cmd.exe invocation with execution flag
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 172,544 bytes but its declared streams total only 94,801 bytes — 77,743 bytes (45%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.