Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 f6e4f64c555e7c0f…

MALICIOUS

Office (OLE) / .DOC

60.9 KB Created: 2006-01-25 08:30:00 Authoring application: Microsoft Office Word
MD5: 43424132879d22e07dd8a4c9ef427437 SHA-1: e24c8a9e19ad1b25c8924c0ed85343e52fdc6ddb SHA-256: f6e4f64c555e7c0fe50b4e827561b6b275cacf38be3de2213c839ac890272a36
80 Risk Score

Malware Insights

The sample is a malicious OLE document that contains a large slack space anomaly. A high-severity heuristic firing indicates a reference to the CreateProcess API, suggesting the document attempts to launch an external process. The document body is filled with unreadable characters, providing no contextual clues. No scripts were extracted from this sample.

Heuristics 2

  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 62,368 bytes but its declared streams total only 21,151 bytes — 41,217 bytes (66%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.