Win.Trojan.Cap-1 — Office (OLE) / .DOC malware analysis

Static analysis result for SHA-256 7645e98395f03229…

MALICIOUS

Office (OLE) / .DOC

1.38 MB Created: 1994-05-11 12:55:00 Authoring application: Microsoft Word 6.0
MD5: 7b71f2d6458ef176d979ad2eac5f88f4 SHA-1: 97ed8c4c29c4c2b7c6c7c89adc2fe78ff3070aee SHA-256: 7645e98395f032297540cd582b460a6880be6ec60451f1adafca455a26339e07
220 Risk Score

Malware Insights

Win.Trojan.Cap-1 · confidence 90%

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file exhibits critical heuristic firings related to embedded Office documents and OLE structure anomalies, including a heap-spray pattern. ClamAV detection identifies it as Win.Trojan.Cap-1. The embedded OLE object is the primary indicator of malicious activity.

Heuristics 5

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • ClamAV: Win.Trojan.Cap-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Cap-1
  • Heap-spray pattern detected high SC_HEAP_SPRAY
    Repeated 0x07 bytes found
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 530,936 bytes but its declared streams total only 0 bytes — 530,936 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off000df608.ole
53c680782e8c07639c4d88726a371c87fcc84b434809086e0ab5bbf28b977178		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0xDF608 530936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.