Office (OLE) malware analysis — malicious · f0c5ad5cc19242c7

MALICIOUS

Office (OLE)

78.4 KB First seen: 2019-01-20

MD5: b3abb35b7a6771df7f2433ad7e11d69c SHA-1: b41ed615150ca231aed67a1a7e4aaa4b998520af SHA-256: f0c5ad5cc19242c7dde3b3339b6144288ec792e262056d7ddcf2c0841bc4df11

70 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The presence of a legacy WordBasic AutoOpen macro indicates the file is designed to automatically execute code when opened. While no VBA code was found, the AutoOpen marker is a strong indicator of malicious intent. The OLE slack anomaly further suggests potential obfuscation or packing within the document structure.

Heuristics 4

OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 80,271 bytes but its declared streams total only 37,175 bytes — 43,096 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.