Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 57b2236ed7f380e0…

MALICIOUS

Office (OLE)

71.5 KB Created: 1984-04-17 16:02:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14
MD5: 69a94ae67bfdd6bd26b8dcb31dd58005 SHA-1: 7df88b3894f778da8db1969b8ad116e12b402cc0 SHA-256: 57b2236ed7f380e097a855c3767e8fdada7b1cc4f0f64c55e7d371c758c8ccce
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of legacy malware, specifically the 'Wazzu' marker associated with WordBasic macro viruses. It also contains suspicious embedded OLE objects and triggers ClamAV detection as 'Win.Trojan.Messenger-2'. The presence of legacy macro virus markers strongly suggests an attempt to execute malicious code, likely for propagation or payload delivery.

Heuristics 4

  • ClamAV: Win.Trojan.Messenger-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Messenger-2
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off0000e523.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0xE523 14557 bytes
SHA-256: 9578481b2d80a512e0e549fdc3655cc0e541fb45aa2519156aa26350eb72b8e3

Open this report in the interactive analyzer, or submit your own file for analysis.