Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 dd11f6bc61b6451a…

MALICIOUS

Office (OLE) / .DOC

186.5 KB First seen: 2022-09-01
MD5: eb40566097e07590d458a5dc254c24e6 SHA-1: 31596d6df0ec6560a258118f0f93b2080dba1c13 SHA-256: dd11f6bc61b6451aa645e0f1b9efc09411433bb94a1dc6503e97bf85c196c340
62 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking

The sample is an OLE document identified as a risky file due to its inclusion of an auto-executable payload. Static analysis revealed an embedded OLE package (ole10native_00.bin) which contains a JAR file. This suggests the document is designed to drop and potentially execute a secondary payload, likely a JAR-based executable.

Heuristics 2

  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ole10native_00.bin
3c3270792b271e4b48a4f7e2e21b4b4ce3d400879a04a6d52e082b82c4074015
ole-package OLE Ole10Native stream: Ole10Native 186573 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.