Office (OLE) malware analysis — malicious · 458a552ce3f1ad13

MALICIOUS

Office (OLE)

20.0 KB Created: 1993-09-28 15:08:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14

MD5: ee3dc0e08e78915fbe0145dda439371a SHA-1: 7a9554cc05f5a9a3ece47fb03b5cf65191426a37 SHA-256: 458a552ce3f1ad13049b2a9825403aba36d429c25b6dbd8266da0e9fd94d782c

220 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Win.Trojan.Mvm-1. It contains legacy WordBasic auto-exec markers (AutoOpen) and an embedded OLE object with suspicious static findings, including empty streams and a FAT chain loop, suggesting potential corruption or obfuscation. The presence of these elements points towards an attack pattern involving spearphishing attachments designed to exploit older Office vulnerabilities or deliver secondary payloads.

Heuristics 4

ClamAV: Win.Trojan.Mvm-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Mvm-1
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00002100.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x2100	12032 bytes
SHA-256: `a4d2ab8d7072b06a79f5dd6ed14a0ef38350ebce9be3ee604d9076118ca859bc`
Detection ClamAV: Win.Trojan.Mvm-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.