Office (OLE) / .DOC malware analysis — malicious · f36b06c9781de2e6

MALICIOUS

Office (OLE) / .DOC

81.7 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word

MD5: d95a58fb36af6723e9c0bc4be0742a36 SHA-1: 82e9417286e61e8d8994367f154f068b23793c92 SHA-256: f36b06c9781de2e6e13f1de60d6877549c3a7ce6d3de625f00324d9ff5cc2d63

80 Risk Score

Malware Insights

The sample is a malicious OLE document that contains a reference to the CreateProcess API, indicating an attempt to execute a process. The large slack space in the OLE structure is also anomalous. No document body or script content was available for further analysis, limiting the ability to determine the specific payload or delivery mechanism.

Heuristics 2

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 83,616 bytes but its declared streams total only 21,151 bytes — 62,465 bytes (75%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.