Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bea10f04f2135fc2…

MALICIOUS

Office (OLE)

23.5 KB Created: 1993-09-28 15:08:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: 226c127f30e5c2a0b18995e3bbf7e124 SHA-1: 616c730289629f2c20066c2b4208fe3ae5bb3d1e SHA-256: bea10f04f2135fc2da6e3b9c13f99298679f682c2ffa857f6cd77e419082450b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an OLE document containing legacy WordBasic auto-exec macro markers, specifically 'AutoClose'. This suggests an attempt to execute arbitrary code upon closing the document, leveraging older Office macro capabilities. The document body contains seemingly unrelated text, likely obfuscation, and the embedded artifact is an OLE file with suspicious static findings, indicating potential further malicious content.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 19,393 bytes but its declared streams total only 0 bytes — 19,393 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off0000123f.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x123F 19393 bytes
SHA-256: 236a712be5dc1a57e87a9162cdc062f52e73d55393031f8f157e2b13539237b2

Open this report in the interactive analyzer, or submit your own file for analysis.