Win.Trojan.Noodle-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 1cdeb2599bbf68d9…

MALICIOUS

Office (OLE)

30.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14
MD5: 9ab0926017177477fd0c6bbbfd36ff96 SHA-1: 220bac74dac5d48b76057292d801aa1565d238fa SHA-256: 1cdeb2599bbf68d9a88b861e78c646ef5f57ead82785d2bc9f8654a00f95fa58
80 Risk Score

Malware Insights

Win.Trojan.Noodle-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains legacy WordBasic macros, specifically an AutoClose macro, which is a strong indicator of malicious intent. The macros attempt to execute commands using the 'debug' utility to write and execute binary data from embedded scripts named 'noodle.scr' and 'drop.scr', ultimately aiming to drop and run a payload. The ClamAV detection explicitly identifies this as Win.Trojan.Noodle-1, supporting the analysis of a trojan payload.

Heuristics 2

  • ClamAV: Win.Trojan.Noodle-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Noodle-1
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.