Win.Trojan.GreenBay-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 1bb024f5ec1bad6d…

MALICIOUS

Office (OLE)

23.5 KB Created: 1993-09-28 15:08:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: ba3c40f6b53f1b4a1ecc0af116d03572 SHA-1: 0d067cecc98be943b4214c1c264109ad053ac4ee SHA-256: 1bb024f5ec1bad6dd5d65eea730e8e7e729555e9b557e3f8ab5b97ceb8bd24dc
280 Risk Score

Malware Insights

Win.Trojan.GreenBay-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus, as indicated by the 'ToolsMacro' heuristic firing. Furthermore, it contains embedded OLE objects with suspicious static findings, suggesting the presence of malicious code designed to be executed. ClamAV detection confirms this, identifying it as Win.Trojan.GreenBay-1.

Heuristics 5

  • ClamAV: Win.Trojan.GreenBay-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.GreenBay-1
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 18,825 bytes but its declared streams total only 0 bytes — 18,825 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00001477.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x1477 18825 bytes
SHA-256: c4dceb54a004e2eebe539d8eec5305ef379372fb00e0c3c1d08ab8d32d37d4f7
Detection
ClamAV: Win.Trojan.GreenBay-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.