Office (OLE) / .DOC malware analysis — malicious · 6d9213fc82aabd11

MALICIOUS

Office (OLE) / .DOC

37.5 KB Created: 1986-05-06 09:30:00 Authoring application: Microsoft Word 6.0

MD5: 2895e4a932c1cf3f325e4bfe29f89fcb SHA-1: ce0caa061d726e429fa12db7d7bd37dc3d0dd238 SHA-256: 6d9213fc82aabd114daccf15507f241ba568528be40c653d72879a4c4a761b16

240 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is a malicious OLE document exhibiting anomalies in its structure, including a large slack space and unreadable streams, indicative of obfuscation or exploitation. ClamAV detections confirm its malicious nature, identifying it as Win.Trojan.Macro-11. The embedded artifact and heuristics suggest an attempt to exploit a client execution vulnerability, likely delivered via spearphishing.

Heuristics 5

Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
ClamAV: Win.Trojan.Macro-11 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Macro-11
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 38,400 bytes but its declared streams total only 20,308 bytes — 18,092 bytes (47%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00004c97.ole` `c22ecfded23a7d5dc498911c8026482dbe56c95651698f4438e6e1916b70cc27`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x4C97	18793 bytes
Detection ClamAV: Win.Trojan.Macro-11 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.