Office (OLE) malware analysis — malicious · e3cbf54051b5e88a

MALICIOUS

Office (OLE)

59.2 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: c17d114655714d8ed0c64061f5a0e955 SHA-1: 0c698b4df66c573233e495df0e98c3643bd52e14 SHA-256: e3cbf54051b5e88aaf7a81e1a4cf56f09750996d74c0442473eb259b3a2c4133

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The sample is an OLE document with a high slack space anomaly, indicating potential obfuscation or embedded malicious content. A high-severity heuristic firing for CreateProcess API suggests the document attempts to launch an external process. The document body is filled with unreadable characters, providing no contextual clues. Without further script or URL evidence, the exact payload and delivery mechanism remain unclear, but the CreateProcess API call is a strong indicator of malicious intent.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 60,576 bytes but its declared streams total only 21,151 bytes — 39,425 bytes (65%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.