Win.Trojan.Mercy-1 Office (OLE) malware analysis — malicious · 1e32c6630030f49e

MALICIOUS

Office (OLE)

22.5 KB Created: 1997-04-08 07:31:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14

MD5: 6aa5c443a3bb2ce45769f163a2e2974d SHA-1: 113964b848e649174f39aa5b9d689a729a6237a6 SHA-256: 1e32c6630030f49e41203494c80620035d16aeefb186baa397145ecc3d77c9f7

262 Risk Score

Malware Insights

Win.Trojan.Mercy-1 · confidence 90%

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Win.Trojan.Mercy-1. It contains legacy WordBasic macros, specifically an AutoOpen macro, which is a strong indicator of malicious intent. The embedded URL is marked as benign, but the presence of the macro and the ClamAV detection strongly suggest this file is designed to execute arbitrary code.

Heuristics 6

ClamAV: Win.Trojan.Mercy-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Mercy-1
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 17,578 bytes but its declared streams total only 0 bytes — 17,578 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.geocities.com/ResearchTriangle/3996 In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00001556.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x1556	17578 bytes
SHA-256: `028e2f69ccecd7cdc3537a06262bae4761daf2bf8372018cea6bad0c283b1b0f`
Detection ClamAV: Win.Trojan.Mercy-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.