Office (OLE) / .DOCX malware analysis — malicious · 25d8bf8c0f0202b8

MALICIOUS

Office (OLE) / .DOCX

29.5 KB Created: 2013-09-15 05:28:00 Authoring application: Microsoft Office Word First seen: 2022-03-17

MD5: 68df4d3bddb1d03d361ff6ea62034463 SHA-1: 0a638820d56d2e53fc4e93d2bab0d65c62ee6071 SHA-256: 25d8bf8c0f0202b88b768ce6d9ac1da61b1168f839718bfa709e5b807d6a4acb

122 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1559.001 Component Object Model Hijacking

The file is a malicious OLE document containing an embedded OLE package (ole10native_00.bin) which is identified as a batch file. Heuristics indicate potential exploitation of CVE-2026-21514 and the presence of an EMF object. The document body instructs the user to 'Enable' content and 'Run' the embedded package, suggesting a social engineering lure to execute the embedded batch file, likely for further payload delivery.

Heuristics 4

Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT

OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `b5959a01549f179b71288d93d0e62cd7742fb8b28564f1e69c1b81db67a9e647`	ole-package	OLE Ole10Native stream: ObjectPool/_1440831339/Ole10Native	550 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.