Office (OLE) malware analysis — malicious · 3dcd487113546eec

MALICIOUS

Office (OLE)

93.0 KB Authoring application: Microsoft Excel First seen: 2012-06-14

MD5: 8177144ff67b9934426bcfdb0305dda6 SHA-1: 5749431f8bc566fb4e4388b7768551651a79aca9 SHA-256: 3dcd487113546eecd33935c1ba98614af7b5e61edc3c85d0a8e4dcb907408d34

262 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as a malicious Excel 5.0 document by multiple heuristics, including critical firings for the 'OLE_XLS5_LAROUX_MACRO_VIRUS' and 'CLAMAV_DETECTION' rules. The presence of Laroux macro markers suggests an attempt to execute arbitrary code via Visual Basic. Although VBA extraction failed due to an unsupported format, the ClamAV detection and macro virus markers strongly indicate malicious intent.

Heuristics 5

ClamAV: Legacy.Trojan.Agent-488 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Legacy.Trojan.Agent-488
Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS

Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED

olevba could not extract VBA macros (AttributeError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00000867.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x867	93081 bytes
SHA-256: `4e9140e5ca60b9b1a5c25bb7d2303759f04f246d1b743656731409bfb2d432d9`
Detection ClamAV: Legacy.Trojan.Agent-488 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.