Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 eca2304242b424c0…

MALICIOUS

Office (OLE)

45.5 KB Created: 1998-07-16 07:55:00 Authoring application: Microsoft Word for Windows 95 First seen: 2026-05-09
MD5: 00db129f271c77b4ce395d814ccaa087 SHA-1: 4a3b54c5118cce976ff48ddb1b569c260234d176 SHA-256: eca2304242b424c0cf9c53ac54bc6116aca80cbb000ccd8d2e2818898807738e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an OLE document with a significant slack space anomaly, suggesting potential obfuscation or embedded malicious content. The presence of auto-executable macro names like AUTOOPEN, FILEOPEN, and AUTOCLOSE strongly indicates an attempt to execute malicious code upon opening or interacting with the document. However, VBA extraction failed due to an unsupported format, preventing deeper analysis of the script's specific actions. The document body contains what appear to be printer driver names and file paths, which is unusual and may be a form of obfuscation or a lure.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 46,592 bytes but its declared streams total only 25,428 bytes — 21,164 bytes (45%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off0000301e.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x301E 34274 bytes
SHA-256: cd4df566b0088ffa2008d9aaf0588d9fcf8cd31a8ebb25b82014d352e7d269aa

Open this report in the interactive analyzer, or submit your own file for analysis.