Office (OLE) malware analysis — malicious · eebc06f8e544fca7

MALICIOUS

Office (OLE)

102.5 KB

MD5: bc65a0da5ed4379837e85e523bdc376c SHA-1: 9b1277b82625900d96812444036027150ec8e6ca SHA-256: eebc06f8e544fca70e86c1d09fbaf7ed3cd3d3ca2dd84ddf58a0e08527a57e2b

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059 Command and Scripting Interpreter

The OLE document exhibits a significant slack space anomaly, indicating a large portion of the file is not used by its apparent structure. Additionally, a reference to the CreateProcess API was detected, which is commonly used by malware to launch other processes. The document body contains references to embedded Excel and PowerPoint objects, further supporting the idea that this file is designed to host and execute malicious content.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 104,960 bytes but its declared streams total only 31,351 bytes — 73,609 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.