Office (OLE) / .DOC malware analysis — malicious · 4e11d1c7be8147fb

MALICIOUS

Office (OLE) / .DOC

404.0 KB Created: 2010-03-30 12:12:00 Authoring application: Microsoft Office Word First seen: 2026-05-10

MD5: 0922d7391343ab678099b147c27d1cd5 SHA-1: 4b9982604df7d9dfb89dca96b4e85fea833310ce SHA-256: 4e11d1c7be8147fb76b754f87a3a82316009403a90f536ea8e2611bbf213925f

400 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample exploits CVE-2007-3899, a memory corruption vulnerability in Microsoft Word, to achieve code execution. It then drops and executes an embedded Portable Executable (PE) file. The document body contains encrypted data, suggesting a lure to trick the user into decrypting and executing the embedded payload.

Heuristics 9

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000493f.exe`	embedded-pe	Office MZ+PE at offset 0x493F	394945 bytes
SHA-256: `0aab070e5ee9bcc302b8dec8296b384059e4bba0ad97ed2fa6c76b89a04c8c76`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): CmdBatNotification
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1331464566/Ole10Native	388929 bytes
SHA-256: `8d6a9f92b9b1ba66bcedad7c3d55c5d3928cf40a6c03e7b43435462838303450`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): CmdBatNotification
`ole10native_00_This_document_is_encrypted_please_doubleclick_HERE_to_decrypt_and_click_on_YES_for_any_warnings_.exe`	ole-package-payload	OLE Ole10Native payload: ObjectPool/_1331464566/Ole10Native; display_name=This document is encrypted, please doubleclick HERE to decrypt and click on YES for any warnings .exe; full_path=C:\DOCUME~1\id012205\Desktop\THISDO~1.EXE; temp_path=; def_file=	388608 bytes
SHA-256: `71e213097f132fa8b1eb68448e904761d0af16e5322b5e430854a9dd01bc85bd`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): CmdBatNotification

Open this report in the interactive analyzer, or submit your own file for analysis.

Office (OLE) / .DOC

Malware Insights

Heuristics 9

Related samples 1

Extracted artifacts 3