Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 f4a22c79c7278380…

MALICIOUS

Office (OLE) / .DOC

84.0 KB Created: 2007-09-18 04:34:00 Authoring application: Microsoft Word 11.
MD5: e4b391d8c453e57e36182bbe13d7bc02 SHA-1: 5b29b2455830f84adb1627714418c7005859dcf4 SHA-256: f4a22c79c727838056e9ec876c2203cc872c731e1092c3e3ff150ea63777eb2a
80 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File Execution T1059 Command and Scripting Interpreter

The sample is a malicious OLE document exhibiting a large slack space anomaly, indicative of embedded malicious content. The PEB access heuristic suggests an attempt to evade detection or manipulate process information. The document body contains obfuscated VBA-like code that appears to be constructing registry paths for disabling Office features, likely to facilitate payload execution or persistence. Specifically, it constructs the registry path HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\3 and HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\1.doc, which could be used to bypass security measures or establish persistence.

Heuristics 2

  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 86,016 bytes but its declared streams total only 16,486 bytes — 69,530 bytes (81%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.