Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 b993ea184812c414…

MALICIOUS

Office (OLE) / .DOC

176.4 KB Created: 2008-01-24 07:45:00 Authoring application: Microsoft Office Word
MD5: a09c1cb2c2c79b3e09e5af09e8c30b2b SHA-1: 257d777b56c4abc40a037a7d0afbaf2f36295985 SHA-256: b993ea184812c414ec64a7029274d029aee5794a07cb498634343ce888497f6c
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The file is identified as malicious by ClamAV with the signature Win.Trojan.Agent-30230. The OLE document exhibits a significant amount of slack space, suggesting potential obfuscation techniques are in use to hide malicious components. No specific attack pattern or IOCs could be definitively extracted from the limited document body and lack of script content.

Heuristics 2

  • ClamAV: Win.Trojan.Agent-30230 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-30230
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 180,640 bytes but its declared streams total only 20,639 bytes — 160,001 bytes (89%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.