Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f0e021289cd9fc93…

MALICIOUS

Office (OLE)

40.0 KB Created: 1998-11-09 11:54:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: 5a5d6cea5602966bdbb91c96e4273305 SHA-1: feaad85442ef2fbac60008741081da55cee8b4b9 SHA-256: f0e021289cd9fc9344e8a88561b6b893db566d2cdf6641557f7f9a06dae71b20
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of legacy malware, specifically triggering heuristics related to WordBasic macro-virus markers and embedded Office document anomalies. The presence of 'ToolsMacro' and the OLE slack anomaly suggest the file is intentionally structured to evade parsing and potentially execute embedded malicious content. While no specific payload or URL was extracted, the combination of findings points to a malicious document designed for code execution.

Heuristics 4

  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 32,512 bytes but its declared streams total only 0 bytes — 32,512 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00002100.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x2100 32512 bytes
SHA-256: 3134cbb46d62db9d1b6581b79ff53fdcc162ea9c018e742ff4bb361667d1c447

Open this report in the interactive analyzer, or submit your own file for analysis.