Win.Trojan.Oblom-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 b0a83867b68a8d9d…

MALICIOUS

Office (OLE)

21.0 KB Created: 1997-08-03 09:49:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: 3cc428fcdb5f1c1cd3842fc3e2bb2126 SHA-1: 81206e67c5a1d5a33fabaa24eb826330ba9014c7 SHA-256: b0a83867b68a8d9d8156b1e977bb82496b91a32d2a346c9ccd0e03940616e2a8
282 Risk Score

Malware Insights

Win.Trojan.Oblom-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as a legacy WordBasic macro-virus by multiple heuristics, including specific markers for ToolsMacro. The embedded document structure is anomalous, suggesting deliberate obfuscation. The document body contains strings indicating malicious intent, such as 'Master of infection' and 'Queen Hitman Virus inc.', and references a URL pattern 'alt.*.virus.*'. The macro code appears to be designed to execute automatically, likely to download and run a secondary payload.

Heuristics 6

  • ClamAV: Win.Trojan.Oblom-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Oblom-1
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. OLE file is 18,587 bytes but its declared streams total only 0 bytes — 18,587 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 190 bytes
SHA-256: 7a60bf4e2c383521a0ba8677a6294659ff6aa87b6d8125ae50da14583922f55d
Preview script
First 1,000 lines of the extracted script
= = = 21349          
        357 "c) 1997 Master of infection...   QUEEN F"
      29472    
  19827 * ,   ,  
29797 ,         = 20339 @cmd7365     @cmd726f    
  = =     = 2816 8704 - = = =
embedded_office_off00000b65.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0xB65 18587 bytes
SHA-256: 10d8f9a1ba6785ab3349e41dea6e3840f515a38988ba1fc80db102d4369e0ebb
Detection
ClamAV: Win.Trojan.Oblom-1
Obfuscation or payload: unlikely
embedded_office_off00001664.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x1664 15772 bytes
SHA-256: a874dee57481c760972fdd0019ff995967a007fb12cc7446743fb5d12f1d5850
Detection
ClamAV: Win.Trojan.Oblom-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.