Malicious Office (OLE) / .EXE — malware analysis report

Static analysis result for SHA-256 798ca969a54e415b…

MALICIOUS

Office (OLE) / .EXE

19.0 KB Created: 1993-09-28 16:08:00 Authoring application: Microsoft Word for Windows 95
MD5: eb29914139cc0d4d451633e22fadf3c3 SHA-1: 60fa21401ce8028d8cf5de7e9f54c0427b3e6615 SHA-256: 798ca969a54e415b599392748e0986e39d568b1825552d05f70160e08a8a8d44
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Doc.Trojan.MinSize-1, indicating it's a known trojan. Heuristics indicate suspicious OLE parsing issues, including empty streams and FAT chain loops, suggesting potential corruption or deliberate obfuscation to evade detection. The embedded artifact is also flagged by ClamAV, reinforcing the malicious nature of the file.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • ClamAV: Doc.Trojan.MinSize-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.MinSize-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00002100.ole
4c9af12dd12094e2b8915f4a6bc561b96f440d3613098954c893fe807c8a1a06		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x2100 11008 bytes
Detection
ClamAV: Doc.Trojan.MinSize-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.