MALICIOUS
240
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The file is identified as malicious by ClamAV with the signature Win.Trojan.MDMA-4. Heuristics indicate an embedded Office document with suspicious static findings, including OLE slack anomalies and unreadable streams, suggesting an attempt to hide malicious content. The embedded artifact 'embedded_office_off0000108a.ole' is likely the malicious component.
Heuristics 5
-
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGEA CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
-
ClamAV: Win.Trojan.MDMA-4 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.MDMA-4
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 26,624 bytes but its declared streams total only 10,220 bytes — 16,404 bytes (62%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMSThe file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_off0000108a.oleef5a77b2472dcfd7c2765e54a25262babb53a3ba47971e3107cdc0829a040aa2 |
embedded-office | Embedded OLE/CFB Office body inside ole container at offset 0x108A | 22390 bytes |
|
Detection
ClamAV:
Win.Trojan.MDMA-4
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.