Office (OLE) / .DO malware analysis — malicious · 746070cfb9b499a4

MALICIOUS

Office (OLE) / .DO

11.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft Word 6.0

MD5: c2576166be723c2ebc68118020f26c52 SHA-1: 8044b4376f7abdb24510fa32da51f8d52d0eba42 SHA-256: 746070cfb9b499a46bee8887fd08b4f52c0785f0c102fdafe2658a5eb2703f78

200 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is an OLE document containing an embedded OLE object, flagged by critical heuristics for suspicious static findings and ClamAV detection as Doc.Trojan.Wazzu-6. The document body contains text that appears to be remnants of macro code and document structure, including references to 'autoOpen' and 'fileMacro', suggesting an attempt to execute embedded code. The primary IOC is the embedded OLE object itself, which likely contains the malicious payload.

Heuristics 4

Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
ClamAV: Doc.Trojan.Wazzu-6 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Wazzu-6
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off0000139b.ole` `87539ceab73a5b262529f2b62ec275796f48be13dd33594e9067da9208283c47`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x139B	6757 bytes
Detection ClamAV: Doc.Trojan.Wazzu-6 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.