Win.Trojan.AgentTesla-6749865-0 Office (OOXML) malware analysis — malicious · 7ffff0ca1cdd3418

MALICIOUS

Office (OOXML)

1.03 MB Created: 2018-09-09 05:41:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2019-12-09

MD5: 99447cefe6515278b5a5eac56aeca27a SHA-1: 576e184470c3ec663a9d1ea2e072cd057a341f77 SHA-256: 7ffff0ca1cdd3418eec2cad779cd1459ce97ba958731ce92b1f1c91b87a09258

204 Risk Score

Malware Insights

Win.Trojan.AgentTesla-6749865-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1129 Shared Content

The file is identified as malicious by ClamAV with the signature Win.Trojan.AgentTesla-6749865-0. Static analysis revealed an embedded OLE object with indicators for an executable payload, specifically noting a '.scr' extension. This strongly suggests an attempt to exploit a vulnerability like CVE-2026-21514 to deliver and execute a secondary stage, likely the AgentTesla trojan.

Heuristics 5

ClamAV: Win.Trojan.AgentTesla-6749865-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.AgentTesla-6749865-0
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	1053184 bytes
SHA-256: `b44b98d573d27220b216db436a0da378a05b52fd381a32a182f1ab68210b7e95`
Detection ClamAV: Win.Trojan.AgentTesla-6749865-0 Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	1042253 bytes
SHA-256: `832419f95894232916a208162eb0f78820f0c0df8fcb9289188958609205486c`
Detection ClamAV: Win.Trojan.AgentTesla-6749865-0 Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.
`emf_00.emf`	ooxml-emf	OOXML EMF part: word/media/image5.emf	8980 bytes
SHA-256: `d8e471990c5c4a0e871ae7f95b01f96f6a3e01e9c850c0147e01cc59b345b93f`
`emf_01.emf`	ooxml-emf	OOXML EMF part: word/media/image4.emf	3544 bytes
SHA-256: `01b237f85da8a31ba924fccaa7ec97ce3ad0ab2a1256dbd3f3fa303d84cc6fb0`
`emf_02.emf`	ooxml-emf	OOXML EMF part: word/media/image3.emf	5092 bytes
SHA-256: `078aa3f140da75248c945994b78e1f2a23b50b979012c63247d7fb4260f0f871`
`emf_03.emf`	ooxml-emf	OOXML EMF part: word/media/image2.emf	18136 bytes
SHA-256: `a8a5b3a975303fbbe8051244d5d5e1e203f4c92b105e83d86e3ee982a7f4551b`
`emf_04.emf`	ooxml-emf	OOXML EMF part: word/media/image1.emf	5200 bytes
SHA-256: `3a1abfff861c281238f1522d0d08d4ba8324e525aa8158cdbd1d50e6392eceb4`
`emf_05.emf`	ooxml-emf	OOXML EMF part: word/media/image6.emf	56816 bytes
SHA-256: `0fbbdd41f0d03a07adeca627a29846a704136da5d09a9eb96a88e7a685b8d123`

Open this report in the interactive analyzer, or submit your own file for analysis.