Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 43ecfb141bd3feb4…

MALICIOUS

Office (OLE) / .DOC

91.0 KB Created: 2010-02-04 13:36:00 Authoring application: Microsoft Word 9.0
MD5: 11b7dc6bc8ff84e13b77d984a3ea75a3 SHA-1: 385b38294b5f851ddcd3a3d672369910a95a0800 SHA-256: 43ecfb141bd3feb40201b2a3a6debe40df7108c19d93969e07d9b2b3e8c7cbfa
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a Microsoft Word document containing an embedded PE executable, identified by the OLE_EMBEDDED_EXE heuristic. The document body discusses a contest for shop window decoration, but the presence of the embedded executable and references to WinExec and VirtualAlloc APIs suggest a malicious intent to execute arbitrary code. The embedded executable is the primary indicator of malicious activity, likely serving as a downloader or initial payload.

Heuristics 5

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.terrassacentre.com/
    • http://www.terrassacentre.com
    • http://www.terrassacentre.como
    • http://www.terrassa.cat/firamodernista

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_0000d004.exe
95e5c9158eb7db36bf27cc88ad4eedad65b94c2dc9a036557fdc51457e851268		 embedded-pe Office MZ+PE at offset 0xD004 39932 bytes
ole10native_00.bin
d15641a6318934c4b635225640501aa020db3d776988327debb404ce27e1b1b4		 ole-package OLE Ole10Native stream: ObjectPool/_1009867771/Ole10Native 41580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.