Office (OLE) / .DOC malware analysis — malicious · e9599ef2c319c65a

MALICIOUS

Office (OLE) / .DOC

139.4 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: 15762d93e4da3f623aded242c3bf36be SHA-1: 890a22e4ffd98cf88366d1fe86e37e0134aabcf6 SHA-256: e9599ef2c319c65a32ff9e0333e7d711c4454401a268701c81d3726699b6a685

320 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1055.012 Process Hollowing T1105 Ingress Tool Transfer

The sample exhibits critical heuristic firings for WriteProcessMemory and CreateRemoteThread, indicating a likely attempt at process injection or hollowing. High-severity firings for CreateProcess, LoadLibrary, and GetProcAddress further support the execution of malicious code. The OLE Slack Anomaly suggests the document may be intentionally malformed to hide malicious content. While no specific document body content was provided for analysis, the combination of these heuristics strongly suggests the document is designed to download and execute a secondary payload, likely leveraging techniques such as process injection.

Heuristics 9

Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 142,752 bytes but its declared streams total only 21,151 bytes — 121,601 bytes (85%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.