Win.Trojan.Fire-4 — Office (OLE) malware analysis

Static analysis result for SHA-256 cffbae6e33ef7faa…

MALICIOUS

Office (OLE)

64.5 KB Created: 1997-01-15 20:30:00 Authoring application: Microsoft Word 6.0 First seen: 2012-06-14
MD5: f0105623b4d2ffcccc536268ff87e15a SHA-1: 0bf53e18a047c7cb9c9b3b9ea26fb1e2987ebdd0 SHA-256: cffbae6e33ef7faa1480ab3c54db7c3768db80199c06a11834a227dee80dbf63
200 Risk Score

Malware Insights

Win.Trojan.Fire-4 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV as Win.Trojan.Fire-4. Static analysis reveals a legacy WordBasic AutoOpen macro, a common indicator of malicious documents. Additionally, embedded OLE objects with parsing anomalies suggest an attempt to hide malicious content or evade detection. The presence of these elements strongly suggests the file is designed to execute malicious code upon opening.

Heuristics 5

  • ClamAV: Win.Trojan.Fire-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Fire-4
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 41,636 bytes but its declared streams total only 0 bytes — 41,636 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00005f5c.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x5F5C 41636 bytes
SHA-256: daac36578a1c97048d789fbbf38a22185d6922b46733da3fdaa1478ff9705981

Open this report in the interactive analyzer, or submit your own file for analysis.