Office (OLE) malware analysis — malicious · 1575ce44de96e82d

MALICIOUS

Office (OLE)

335.0 KB Created: 2007-07-19 09:32:00 Authoring application: Microsoft Office Word First seen: 2018-02-07

MD5: ddaff1b349663722e7f70ddcc7e7271c SHA-1: a547125da5bcdb45ac968ab5eecae54decc54bea SHA-256: 1575ce44de96e82ddc1d709a55590096feb3ecb7194daa4967c3ae959de8f9af

222 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document containing an embedded executable file (MZ header at offset 0x35404) and references to WinExec and VirtualAlloc APIs. It also includes an embedded URL, http://www.5iantlavalamp.com/, which may be used for command and control or to download additional payloads. The presence of an embedded executable and the use of OLE package dropping techniques indicate a likely attempt to deliver a secondary payload.

Heuristics 6

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.5iantlavalamp.com/ In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00035404.exe`	embedded-pe	Office MZ+PE at offset 0x35404	124924 bytes
SHA-256: `4e150d124f7d9f38f30444aa3421989cb151726368ca3b5c00a7cfc2abf4f3f9`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1014645583/Ole10Native	41580 bytes
SHA-256: `d478059435ef9744848c518cd46697f12a518562aa82dcfc61b35db6e33cdb00`

Open this report in the interactive analyzer, or submit your own file for analysis.