Office (OLE) / .EXE malware analysis — malicious · 17aebac18ad70646

MALICIOUS

Office (OLE) / .EXE

55.5 KB Created: 1993-09-28 15:08:00 Authoring application: Microsoft Word for Windows 95

MD5: 4c28508db90e78b1fa0c14e8fe0480bc SHA-1: 89b13e62cbf33190913ae389406fb22719a63c41 SHA-256: 17aebac18ad70646dc1cfa94bafaf6bae088bb2f0d0e0374daf8ef9cbf290add

240 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with multiple critical heuristic firings related to OLE structure anomalies and embedded content. The presence of an embedded OLE file suggests it may contain further malicious content or exploits. The document body text appears to be unrelated boilerplate, indicating the primary malicious function is likely within the embedded artifact or via an exploit.

Heuristics 5

Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
ClamAV: Win.Trojan.WordMacro-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.WordMacro-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 54,055 bytes but its declared streams total only 0 bytes — 54,055 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00000ad9.ole` `bddfb23173f8403b14197bc514c72a2c5c653c13d0070e83d2b2ba11362424e3`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0xAD9	54055 bytes
Detection ClamAV: Win.Trojan.Funfun-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.