Office (OLE) / .DOC malware analysis — malicious · dbc0a1bfbddceba2

MALICIOUS

Office (OLE) / .DOC

92.0 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: d05e0400b62687b5796c5d1b5ccdf6ee SHA-1: 7d43c6057710f6c5cf338adcfe4032d30c4088ab SHA-256: dbc0a1bfbddceba2afd48e6f30bf2fe0f70707dae1a4f8ae6a0bcdcc27ded36b

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1071.001 Web Protocols

The OLE document exhibits a large slack space anomaly, suggesting hidden or packed content. Heuristics indicate the use of Windows API functions like VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress, commonly employed by malware to allocate memory, modify its protection, and load dynamic libraries. This points towards a downloader or dropper mechanism designed to fetch and execute a secondary payload.

Heuristics 5

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 94,224 bytes but its declared streams total only 21,151 bytes — 73,073 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.