Office (OLE) malware analysis — malicious · 42898e381a4505fc

MALICIOUS

Office (OLE)

106.5 KB Created: 2014-08-02 12:55:00 Authoring application: Microsoft Office Word First seen: 2017-05-13

MD5: ce851b6c3338494acef127f8d9709eaf SHA-1: 82c67a8eb7ed4aa64c7c8e7f5f64af5dbc6a733f SHA-256: 42898e381a4505fc73d221b825fa9a184b862652630ec34461c0f8f511b8a2f7

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an OLE document containing an Ole10Native object, which is a known vector for dropping executable payloads. Heuristics indicate a potential exploitation of CVE-2026-21514 and that the package is designed to drop an auto-executable payload. The document body contains Vietnamese text related to a power of attorney, which is likely a lure.

Heuristics 2

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1350276910/Ole10Native	56428 bytes
SHA-256: `1944c961e68ae9356b7f274f69dfb0bcb70dfca083c8ac3471deaf05b654b681`

Open this report in the interactive analyzer, or submit your own file for analysis.