Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 651327f3d24d9a89…

MALICIOUS

Office (OLE)

71.0 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14
MD5: 8ca37a3fa9b29b0a04dea3b961ec9537 SHA-1: 1844ad9f40d693fd12d3cc4adfaab76719d9c93e SHA-256: 651327f3d24d9a89f391fc028bb86f1f4a49e0de752b98e58e9e69319d45ccb2
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV and exhibits critical static findings related to OLE parsing anomalies and legacy WordBasic auto-exec markers, specifically 'AutoOpen'. The presence of these indicators suggests an attempt to exploit older Office vulnerabilities and execute embedded macros. The document body contains fragmented text that appears to be related to macro commands and file paths, further supporting the macro execution vector.

Heuristics 5

  • ClamAV: Win.Trojan.CVCK1-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.CVCK1-1
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 60,927 bytes but its declared streams total only 0 bytes — 60,927 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00002e01.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x2E01 60927 bytes
SHA-256: 48d8476b9459fbc9b0e3ecd972a8d15fc3d59211c7efc6c8098cdaf39a016dba

Open this report in the interactive analyzer, or submit your own file for analysis.