Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0d726f1605d8a21a…

MALICIOUS

Office (OLE)

111.5 KB Created: 2017-07-14 20:16:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: 321f335bfda5e72fb4114cf32d2a037e SHA-1: 611b03bd5551c868836953bfa2b1994a4750da70 SHA-256: 0d726f1605d8a21a1f2d205d2c08f7adff9de11f3d450c098288b38cbc99d830
162 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an OLE document containing an embedded Ole10Native object, which is a known method for dropping executable payloads. Heuristics indicate a high likelihood of exploitation for client execution and the potential for dropping an executable file. The document body appears to be a legitimate business communication, suggesting a spearphishing attachment vector.

Heuristics 5

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/illustrator/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_977813033/Ole10Native 41580 bytes
SHA-256: b05f68ac943d3a9865785d492748a81b4022ab6435d8076c592a06acace55ad1

Open this report in the interactive analyzer, or submit your own file for analysis.