Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 3faf9bab4b15466f…

MALICIOUS

Office (OLE) / .DOC

1.69 MB Created: 2010-04-07 19:42:00 Authoring application: Microsoft Office Word
MD5: bdc0ed6e8ea3d09280ce3952a9f11c1e SHA-1: f3716b33e922ba0befe4b4940d8d2e4a7953c3a1 SHA-256: 3faf9bab4b15466f0c1681d3b5014895291423c28ef3a1f3c4739b675f181ffe
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The sample is a malicious OLE document containing an embedded PE executable. It also exhibits heuristics related to ShellExecute, LoadLibrary, and GetProcAddress, indicating dynamic code execution. The document body suggests a lure to open embedded registration files, which is a common tactic for delivering malware. The presence of an embedded executable and the use of API calls point towards a downloader or dropper functionality.

Heuristics 7

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00006077.exe
fbf85d3adf48cb4b11b6f10861fad8224ae436f5061200ece76b65492721ddd6		 embedded-pe Office MZ+PE at offset 0x6077 1750921 bytes
ole10native_00.bin
11ee9014fbbf0803bfad287fc93de56fb5bf438f3e0a4d0885fd7c122cf416dc		 ole-package OLE Ole10Native stream: ObjectPool/_1332178765/Ole10Native 574208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.