Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8c3f47aea8a06582…

MALICIOUS

Office (OLE)

516.6 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: 73fadb8f36e4f34a6d4719dc4ccbe666 SHA-1: 32dadb2c0d7a33c33a385fada39ffe2fd74dd495 SHA-256: 8c3f47aea8a06582bbf9eb8d04365323bd45db16a0e6a7adf9425d26c68984d9
100 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious File T1059 Command and Scripting Interpreter

The file is identified as malicious by ClamAV with the signature Win.Trojan.Agent-30229. The OLE document exhibits a large slack space anomaly, suggesting it may contain hidden or obfuscated data. The document body contains heavily corrupted or unprintable characters, indicating it is not intended for direct user consumption and likely serves as a lure or container for malicious content. The combination of these factors points to a malicious document designed to exploit vulnerabilities and download further payloads.

Heuristics 2

  • ClamAV: Win.Trojan.Agent-30229 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-30229
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 528,993 bytes but its declared streams total only 94,801 bytes — 434,192 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).