Win.Trojan.Olympic-3 Office (OLE) malware analysis — malicious · 905816335f7059df

MALICIOUS

Office (OLE)

25.0 KB Created: 1996-08-01 11:54:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14

MD5: c1e109a5f1e3d7c034ab8e45cb228219 SHA-1: d1cf6d11de14436f9d6f424f0740ff31f8819211 SHA-256: 905816335f7059df79c6d348690e52b96f2ebc1c725017340cae152b9352603f

260 Risk Score

Malware Insights

Win.Trojan.Olympic-3 · confidence 90%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Win.Trojan.Olympic-3. Static analysis reveals the presence of a legacy WordBasic AUTOOPEN macro, which is a common technique for executing malicious code upon document opening. The embedded OLE structure also shows anomalies, suggesting deliberate obfuscation or corruption to evade detection. The macro's likely intent is to download and execute a secondary payload.

Heuristics 5

ClamAV: Win.Trojan.Olympic-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Olympic-3
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 21,289 bytes but its declared streams total only 0 bytes — 21,289 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off000010d7.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x10D7	21289 bytes
SHA-256: `3285733a168b1bad90b26b1f9cd9ac676a6666390c39ebc4eb339f6fccb3bafb`
Detection ClamAV: Win.Trojan.Olympic-3 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.