Office (OLE) malware analysis — malicious · 41ea1f970fa4caa9

MALICIOUS

Office (OLE)

145.5 KB Created: 2016-04-21 12:03:00 Authoring application: Microsoft Office Word First seen: 2019-04-18

MD5: d22624733e6ec4b03e23e8a7e7c0395f SHA-1: 19788a1979acb8b8bc90c872aa592197dd695a0f SHA-256: 41ea1f970fa4caa9f01c6b0e3ae3237bfffe7c2194ceedea4f52727c8988e600

202 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious Office document containing an embedded executable file (embedded_office_0000604c.exe). It also contains a legacy WordBasic AutoOpen macro, which is a common technique for executing embedded content. The presence of the embedded PE executable strongly suggests the document's purpose is to deliver a secondary payload.

Heuristics 6

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000604c.exe`	embedded-pe	Office MZ+PE at offset 0x604C	124340 bytes
SHA-256: `8d69330d6786d9b0c316e6cb6f7dbd9804613688679dcf12ed71a59bec576a17`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1522765563/Ole10Native	93894 bytes
SHA-256: `2e28f382f6ffe9984216ee0cd380902e1fe3610e601bc8a5b68480e4a36abb1d`

Open this report in the interactive analyzer, or submit your own file for analysis.