Win.Packed.Nanocore-10025342-0 — Office (OOXML) malware analysis

Static analysis result for SHA-256 28f3d7085899df17…

MALICIOUS

Office (OOXML)

472.3 KB Created: 2020-02-14 15:06:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-06-01
MD5: 9aa75eba1f999a886c6b664153a09b2f SHA-1: dc9962d09c620bf9e6b8de88c7ef25e625c16299 SHA-256: 28f3d7085899df17d2bd1692aa15cb739b363e0830c4b262c2583bf1df841a16
242 Risk Score

Malware Insights

Win.Packed.Nanocore-10025342-0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1140 Deobfuscate/Decode Files or Information

The file is a malicious OOXML document containing an embedded OLE object that likely exploits CVE-2026-21514 to drop an executable payload. ClamAV signatures confirm the presence of Win.Packed.Nanocore-10025342-0, indicating a packed malware dropper. The embedded OLE object and the detected malware family strongly suggest this document is intended to be delivered via spearphishing.

Heuristics 5

  • OOXML Ole10Native with payload/link indicators — possible CVE-2026-21514 high CVE likely CVE_2026_21514
    Office document contains embedded OLE (word/embeddings/oleObject1.bin) with Ole10Native plus executable, PE, or risky remote-link indicators. This is a likely CVE-2026-21514 exploitation shape.
  • ClamAV: Win.Packed.Nanocore-10025342-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Packed.Nanocore-10025342-0
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/SMI/2005/WindowsSettingsIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 1329152 bytes
SHA-256: b52e65d4ddfe0b84a0a27a854203eb0f13f9c596e607fa1c098f6b7b66be5a95
Detection
ClamAV: Win.Packed.Nanocore-10025342-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 1316176 bytes
SHA-256: f9e2c58c07e93b5c7ca0b3aef8b0f37c833dd5aedb51a509dad24bfd5b731cdd
Detection
ClamAV: Win.Packed.Nanocore-10025342-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 5456 bytes
SHA-256: b5fa75713f3d0391e7a92810fa7f63519d8748b23d901437ed32b1ac9bf4a21a

Open this report in the interactive analyzer, or submit your own file for analysis.