MALICIOUS
362
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The sample exploits CVE-2007-3899, a memory corruption vulnerability in Microsoft Word, to execute arbitrary code. The embedded OLE package contains a script that attempts to download and execute a payload from a provided URL. The document body's content, while containing a name and a lure to open a resume in Adobe Reader, is likely a distraction from the underlying exploit.
Heuristics 9
-
CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
-
OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
-
Ole10Native package payload is a download-and-execute script critical OFFICE_PACKAGE_SCRIPT_DROPPERThe OLE Package's embedded payload contains a script that hosts a shell (PowerShell/WScript/mshta), fetches a remote resource, and executes it — a download-and-run dropper. Embedding such a script inside an Office document via the Object Packager is a direct user-execution delivery technique (MITRE T1204.002), not a benign attachment.
-
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILEOLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
Disassembly
Attempted x86 opcode disassembly000996F9 e800000000 call 0x996fe 000996FE 58 pop eax 000996FF 055a0b0000 add eax, 0xb5a 00099704 8b30 mov esi, dword ptr [eax] 00099706 03f0 add esi, eax 00099708 2bc0 sub eax, eax 0009970A 8bfe mov edi, esi 0009970C 66ad lodsw ax, word ptr [esi] 0009970E c1e00c shl eax, 0xc 00099711 8bc8 mov ecx, eax 00099713 50 push eax 00099714 ad lodsd eax, dword ptr [esi] 00099715 2bc8 sub ecx, eax 00099717 03f1 add esi, ecx 00099719 8bc8 mov ecx, eax 0009971B 57 push edi 0009971C 51 push ecx 0009971D 49 dec ecx 0009971E 8a443906 mov al, byte ptr [ecx + edi + 6] 00099722 880431 mov byte ptr [ecx + esi], al 00099725 75f6 jne 0x9971d 00099727 2bc0 sub eax, eax 00099729 ac lodsb al, byte ptr [esi] 0009972A 8bc8 mov ecx, eax 0009972C 80e1f0 and cl, 0xf0 0009972F 240f and al, 0xf 00099731 c1e10c shl ecx, 0xc 00099734 8ae8 mov ch, al 00099736 ac lodsb al, byte ptr [esi] 00099737 0bc8 or ecx, eax 00099739 51 push ecx 0009973A 02cd add cl, ch 0009973C bd00fdffff mov ebp, 0xfffffd00 00099741 d3e5 shl ebp, cl 00099743 59 pop ecx 00099744 58 pop eax 00099745 8bdc mov ebx, esp 00099747 8da46c90f1ffff lea esp, [esp + ebp*2 - 0xe70] 0009974E 51 push ecx 0009974F 2bc9 sub ecx, ecx 00099751 51 push ecx 00099752 51 push ecx 00099753 8bcc mov ecx, esp 00099755 51 push ecx 00099756 668b17 mov dx, word ptr [edi]
-
Reference to ShellExecute API high SC_STR_SHELLEXECReference to ShellExecute API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ocsp.thawte.com0 Embedded OLE package script
- http://ts-ocsp.ws.symantec.com07Embedded OLE package script
- http://crl.thawte.com/ThawteTimestampingCA.crl0Embedded OLE package script
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0Embedded OLE package script
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0Embedded OLE package script
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ole10native_00.bin |
ole-package | OLE Ole10Native stream: ObjectPool/_1483328472/Ole10Native | 795687 bytes |
SHA-256: 2b62fda38ca95df0d3f404800db28d799af676dc8c3ce80a452703b0cec8b580 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_GETPROCADDRESS, SC_STR_SHELLEXEC, SC_GETPC_CALL Static shellcode analysis recovered API/import strings: kernel32.dll, advapi32.dll, shell32.dll, KERNEL32.DLL, ADVAPI32.DLL, GetProcAddress Carved artifact entropy is 8.00, consistent with packed or encrypted content.
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.