Doc.Dropper.Agent-6519255-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 2c23ac4b312aa9fb…

MALICIOUS

Office (OLE)

819.5 KB Created: 2014-12-02 01:31:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 488ba9382c9ee260bbca1ef03e843981 SHA-1: ca86b723d2ec91c72114a9e09d3d0131adb46f36 SHA-256: 2c23ac4b312aa9fbef857b5ea519852a1a93536e9df1c113eb0dd6b9bc206fa4
422 Risk Score

Malware Insights

Doc.Dropper.Agent-6519255-0 · confidence 90%

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a Microsoft Word document that exploits CVE-2007-3899, a memory corruption vulnerability, to execute arbitrary code. It contains an embedded OLE package that acts as a script dropper, designed to download and execute a payload. The embedded URLs suggest an attempt to fetch a second-stage payload, likely an executable file as indicated by the 'exe' extension in the heuristics.

Heuristics 10

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • ClamAV: Doc.Dropper.Agent-6519255-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6519255-0
  • Ole10Native package payload is a download-and-execute script critical OFFICE_PACKAGE_SCRIPT_DROPPER
    The OLE Package's embedded payload contains a script that hosts a shell (PowerShell/WScript/mshta), fetches a remote resource, and executes it — a download-and-run dropper. Embedding such a script inside an Office document via the Object Packager is a direct user-execution delivery technique (MITRE T1204.002), not a benign attachment.
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
    Disassembly
    Attempted x86 opcode disassembly
    000998F9  e800000000        call 0x998fe
000998FE  58                pop eax
000998FF  055a0b0000        add eax, 0xb5a
00099904  8b30              mov esi, dword ptr [eax]
00099906  03f0              add esi, eax
00099908  2bc0              sub eax, eax
0009990A  8bfe              mov edi, esi
0009990C  66ad              lodsw ax, word ptr [esi]
0009990E  c1e00c            shl eax, 0xc
00099911  8bc8              mov ecx, eax
00099913  50                push eax
00099914  ad                lodsd eax, dword ptr [esi]
00099915  2bc8              sub ecx, eax
00099917  03f1              add esi, ecx
00099919  8bc8              mov ecx, eax
0009991B  57                push edi
0009991C  51                push ecx
0009991D  49                dec ecx
0009991E  8a443906          mov al, byte ptr [ecx + edi + 6]
00099922  880431            mov byte ptr [ecx + esi], al
00099925  75f6              jne 0x9991d
00099927  2bc0              sub eax, eax
00099929  ac                lodsb al, byte ptr [esi]
0009992A  8bc8              mov ecx, eax
0009992C  80e1f0            and cl, 0xf0
0009992F  240f              and al, 0xf
00099931  c1e10c            shl ecx, 0xc
00099934  8ae8              mov ch, al
00099936  ac                lodsb al, byte ptr [esi]
00099937  0bc8              or ecx, eax
00099939  51                push ecx
0009993A  02cd              add cl, ch
0009993C  bd00fdffff        mov ebp, 0xfffffd00
00099941  d3e5              shl ebp, cl
00099943  59                pop ecx
00099944  58                pop eax
00099945  8bdc              mov ebx, esp
00099947  8da46c90f1ffff    lea esp, [esp + ebp*2 - 0xe70]
0009994E  51                push ecx
0009994F  2bc9              sub ecx, ecx
00099951  51                push ecx
00099952  51                push ecx
00099953  8bcc              mov ecx, esp
00099955  51                push ecx
00099956  668b17            mov dx, word ptr [edi]
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.thawte.com0 Embedded OLE package script
    • http://ts-ocsp.ws.symantec.com07Embedded OLE package script
    • http://crl.thawte.com/ThawteTimestampingCA.crl0Embedded OLE package script
    • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0Embedded OLE package script
    • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0Embedded OLE package script

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_1483034456/Ole10Native 795687 bytes
SHA-256: 5497deed2454dc9e37be4d32341cf2938f5dc1a7c35547d2590f969a38a4617e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_GETPROCADDRESS, SC_STR_SHELLEXEC, SC_GETPC_CALL Static shellcode analysis recovered API/import strings: kernel32.dll, advapi32.dll, shell32.dll, KERNEL32.DLL, ADVAPI32.DLL, GetProcAddress Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.