Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 f571af475ad0158f…

MALICIOUS

Office (OLE) / .DOC

110.5 KB Created: 2007-11-03 09:34:00 Authoring application: Microsoft Office Word
MD5: 4a83fb3843a8ad15d1f456f91e201e1d SHA-1: d3c8df5fe5aa09b9db37f500381a905d21968d51 SHA-256: f571af475ad0158fce4b141e2f0f8de2a1b7d83c7d1a84020ca421718a76ff1a
100 Risk Score

Malware Insights

MITRE ATT&CK
T1027 Obfuscated Files or Information

The sample exhibits characteristics of a malicious document, including the presence of XOR-encoded strings and a significant amount of slack space within the OLE structure, which are common evasion techniques. The document body is unreadable, and no scripts were extracted, limiting further analysis of the specific payload or delivery mechanism. The high percentage of slack space (82%) strongly indicates an attempt to hide malicious content.

Heuristics 2

  • XOR-encoded strings (key 0x6D) critical SC_XOR_ENCODED
    Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0x6D: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess', 'CreateFileA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 113,152 bytes but its declared streams total only 20,639 bytes — 92,513 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.