Office (OLE) malware analysis — malicious · 98cef69d70bbfeb0

MALICIOUS

Office (OLE)

19.5 KB Created: 1999-01-31 22:23:00 Authoring application: Microsoft Word 6.0 First seen: 2012-10-03

MD5: 0c12d5715fd22148ffc9ff90323fe643 SHA-1: f28ce117bf52342d04821a5fa782eb6e1e2a947e SHA-256: 98cef69d70bbfeb0dd6ed39acc88ec5b0c2fc398f068babf9b106234e87b0130

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an OLE document containing legacy WordBasic macro virus markers, indicating an attempt to execute embedded code. The presence of embedded Office child findings and empty OLE streams suggests a deliberately malformed or obfuscated structure. The document body contains what appears to be a technical report or analysis, but the macro functionality is the primary indicator of malicious intent, likely to download and execute a second-stage payload.

Heuristics 3

Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS

This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_off00001a40.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x1A40	13248 bytes
SHA-256: `9ed371f102d7c58b0972a09bce67bcae004226f28697266b361eb5dbbd5047f5`

Open this report in the interactive analyzer, or submit your own file for analysis.