Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d7ecb6b1e72e1503…

MALICIOUS

Office (OLE)

141.0 KB First seen: 2017-10-10
MD5: 017f854f97de9b1f02045b0156f18593 SHA-1: 250cc136bc39ab4782c2c1c52111609cbf408ad2 SHA-256: d7ecb6b1e72e15035de92cf501615c73532a91bbc973230b36673cbe460e997e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is an OLE document containing legacy WordBasic macro virus markers and exhibits OLE slack anomalies, indicating potential obfuscation or malicious content. The document body discusses tax regulations and loan agreements, suggesting a lure to disguise malicious intent. The presence of an embedded OLE object further supports the likelihood of a multi-stage attack.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 144,384 bytes but its declared streams total only 43,263 bytes — 101,121 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00000697.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x697 142697 bytes
SHA-256: ee2b9c2bf90e57658889cfce91f77a55618f84728a82aa15d8830df468a3b60f

Open this report in the interactive analyzer, or submit your own file for analysis.