Malicious Office (OLE) / .TMP — malware analysis report

Static analysis result for SHA-256 f8d50c823792dbe3…

MALICIOUS

Office (OLE) / .TMP

169.0 KB Created: 2009-02-26 07:53:00 Authoring application: Microsoft Office Word
MD5: f52e3c5718036e3b7a941e93fc77d8d9 SHA-1: 69710aa2efe235086f21ac7356e41a2ccb2068dd SHA-256: f8d50c823792dbe399b9ef959b4c75ec2722872f8688ec10e6388b8b8e83c95d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The file is identified as malicious with a critical heuristic firing for XOR-encoded strings, using the key 0xC2. Additionally, a high heuristic indicates a significant amount of slack space within the OLE structure, suggesting obfuscation or embedded malicious content. An embedded URL was also detected. The presence of these indicators points towards a malicious document, likely a downloader or dropper, though the specific family is not identifiable.

Heuristics 2

  • XOR-encoded strings (key 0xC2) critical SC_XOR_ENCODED
    Found 2 Windows library/API name(s) XOR-encoded with single-byte key 0xC2: 'advapi32.dll', 'RegOpenKeyExA'
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 173,060 bytes but its declared streams total only 16,543 bytes — 156,517 bytes (90%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.