Office (OLE) malware analysis — malicious · db7095d7ae5f6be7

MALICIOUS

Office (OLE)

91.4 KB Created: 2018-11-29 14:01:00 Authoring application: Microsoft Office Word First seen: 2019-11-20

MD5: 6a70bcf3c7f27d2cd5aa8ae46cfb9af8 SHA-1: a495f0e6312a931a77a82a70801ae3fa009e629c SHA-256: db7095d7ae5f6be7739fe64d86d365680b84706a7968851711380f16fb8920ab

82 Risk Score

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 93,568 bytes but its declared streams total only 51,411 bytes — 42,157 bytes (45%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.