Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 34574c0c9851fdbe…

MALICIOUS

Office (OLE)

944.0 KB Created: 2003-08-31 06:46:00 Authoring application: Microsoft Word 10.0 First seen: 2019-05-31
MD5: ddb07539fe928574fff8f2a04546954c SHA-1: 3c38330e0e0758738ebcb9ca072391d6046c0bb0 SHA-256: 34574c0c9851fdbe92c906a13c5c2c839cd31d2691e215de745980e4e4446239
420 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The file is an OLE document containing an embedded executable and a Flash object, flagged as risky. The document body's German text, 'Achtung: Nach dem starten der *.exe das T-Shirt vorsichtig mit der Maus berühren (und ruhig bleiben). EMBED Package', suggests a lure to execute the embedded file. The presence of WinExec, CreateProcess, LoadLibrary, and GetProcAddress API references further indicates the execution of external code.

Heuristics 9

  • Legacy Flash object embedded in Office document high CVE related OFFICE_LEGACY_SWF_OBJECT
    Office document embeds a ShockwaveFlash ActiveX object with a legacy SWF version (5). This is old Flash-in-Office exploit-family evidence, not a specific Flash CVE without SWF tag-level validation.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Embedded Adobe Flash (SWF) in OLE document critical OFFICE_EMBEDDED_SWF
    Document contains an embedded Adobe Flash (SWF) object. Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00004c54.exe embedded-pe Office MZ+PE at offset 0x4C54 947116 bytes
SHA-256: bca97099c7dc25b163e3a3300a549d4ce3e0d17177c27eb0f752a2d7a404bfb7
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_1093778926/Ole10Native 943524 bytes
SHA-256: c4a5a41f0a47e1c90c40b0828d8c169642da3a6aebc83e270b4a3dfc1c51c1de

Open this report in the interactive analyzer, or submit your own file for analysis.