Detection Method: OLE analysis
OLE (Object Linking and Embedding) analysis examines embedded objects in Microsoft Office documents to detect potentially harmful content and behavior. This method focuses on the OLE2 container format used in many Office files, which can hide threats like malicious macros, executable code, or dangerous external links.
OLE analysis can help you detect:
- Malicious VBA macros that run automatically when documents are opened
- Hidden executable code or scripts embedded within document objects
- External relationships linking to malicious or suspicious resources
- Encryption used to hide malicious content
- Flash objects that might contain exploitable vulnerabilities
- Attempts to exploit known vulnerabilities in Office applications
For example, attackers might embed macros that execute as soon as you open the document, or include external links that download additional malware when clicked. OLE analysis helps catch these hidden threats early.