Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e3eabfbdc887a3ea…

MALICIOUS

Office (OLE)

37.5 KB Created: 1997-10-13 12:49:00 Authoring application: Microsoft Word 8.0
MD5: d7056a9dc1a49b401c2557dc2e4866de SHA-1: 4ddd3051ca3b1813eced6efbeb960a4f8e470c0a SHA-256: e3eabfbdc887a3eac469bb7013c60b08d824ea841d5f5c24da9c57ea063f53f6
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an OLE document with a significant amount of slack space, indicating potential obfuscation. It contains a VBA macro, specifically an AutoOpen macro, which is designed to execute automatically when the document is opened. This macro is likely responsible for the malicious behavior, although its specific actions are not detailed in the provided evidence. The presence of an AutoOpen macro strongly suggests an attack pattern involving malicious document attachments.

Heuristics 3

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 38,400 bytes but its declared streams total only 18,514 bytes — 19,886 bytes (52%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
60b53da15e6e03989bd357ee0d1d3f27d681d1b90737cd841cb346bb2e2af32e		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 918 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.