Win.Trojan.Eraser-13 — Office (OLE) malware analysis

Static analysis result for SHA-256 f455f213cd20f368…

MALICIOUS

Office (OLE)

31.0 KB Created: 1997-04-05 11:33:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: dd377388ac8e2e7799e579dd89a6aa45 SHA-1: e9f23dbaaf6109b9f68b6f279b26b62d79c781a4 SHA-256: f455f213cd20f36868975da7db2563f63754c6ef95c7ef5add6570063e2ea70e
220 Risk Score

Malware Insights

Win.Trojan.Eraser-13 · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic

The sample was identified as a legacy WordBasic macro-virus by heuristics, specifically noting the presence of markers like 'TOOLSMACRO'. Further analysis revealed anomalies in the OLE structure, including empty streams and a large unaccounted-for region, indicating deliberate obfuscation or corruption. ClamAV also detected it as Win.Trojan.Eraser-13, reinforcing its malicious nature.

Heuristics 5

  • ClamAV: Win.Trojan.Eraser-13 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Eraser-13
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 16,818 bytes but its declared streams total only 0 bytes — 16,818 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off00003a4e.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x3A4E 16818 bytes
SHA-256: 07b6baa920bfe1a02f8271131979a50af14a52275cae5a6c4fdd59524c8e34f4
embedded_office_off0000514e.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x514E 10930 bytes
SHA-256: fbc8c45710ba566f003ae2ecb461c4ec49150a13ad4104135b9b74381ea36971

Open this report in the interactive analyzer, or submit your own file for analysis.