Win.Trojan.Balrog-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 bed30b9f52ab9742…

MALICIOUS

Office (OLE)

53.5 KB Created: 1997-02-21 12:13:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14
MD5: fbef01208b4c2d28ef3a8ae216f9debb SHA-1: b68906ded8f929189f8f75c53e4c098c830bb55f SHA-256: bed30b9f52ab9742af4f12748b30dd17f70df0a76878baf5bba574703223ad39
220 Risk Score

Malware Insights

Win.Trojan.Balrog-1 · confidence 85%

MITRE ATT&CK
T1059.005 Visual Basic

The file exhibits characteristics of legacy malware, specifically WordBasic macro virus markers and anomalous OLE structures, suggesting it may be an older malicious document. ClamAV identifies it as Win.Trojan.Balrog-1. The presence of legacy macro virus markers points towards the use of Visual Basic for macro execution.

Heuristics 5

  • ClamAV: Win.Trojan.Balrog-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Balrog-1
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. OLE file is 27,616 bytes but its declared streams total only 0 bytes — 27,616 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00006a20.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x6A20 27616 bytes
SHA-256: 7a15f20dbc50b2cc040d4cce60da6c9684d97614bb696f38866212579ce3b3c0
embedded_office_off00008ea4.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x8EA4 18268 bytes
SHA-256: 1ff37945dc316a19e12a2eafc08dcc3271a38608d3114e4b32d17c90ceda2832

Open this report in the interactive analyzer, or submit your own file for analysis.