Office (OLE) malware analysis — malicious · 0a920b13c28f53c1

MALICIOUS

Office (OLE)

180.5 KB Created: 2018-04-20 21:12:00 Authoring application: Microsoft Office Word First seen: 2019-04-18

MD5: 52c7a36e5ca4ef535f3004aaf7f37d09 SHA-1: 1becfd5918ae039a7de1420ce1694b2861be858e SHA-256: 0a920b13c28f53c16540e9b69d2a81e734b1917d68f454822b6616959b4ff62d

262 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document contains a DDEAUTO field that executes a PowerShell command. This command downloads and executes a second-stage payload from the URL http://88.99.104.179:1985/win_update/upgrade. The presence of Ole10Native and a suspicious embedded file further indicates malicious intent, likely as a dropper.

Heuristics 7

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
ClamAV: Doc.Dropper.Agent-6539517-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6539517-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://88.99.104.179:1985/win_update/upgrade In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1586990151/Ole10Native	1512 bytes
SHA-256: `50df5e28fcbf93421250485bbe10265cecdc9d64bbb404c87bcdf58d5278d4d0`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): powershell.exe, PowerShell\v1.0\powershell.exe

Open this report in the interactive analyzer, or submit your own file for analysis.