Office (OLE) malware analysis — malicious · 4e8397d06cb26012

MALICIOUS

Office (OLE)

178.0 KB Created: 1999-06-01 19:59:00 Authoring application: Microsoft Word 8.0 First seen: 2019-08-04

MD5: bebbd3b6cb35c7213d51aa9e6a25c4a2 SHA-1: e13b2d20818c13158c65316cab1c23962d81ef5b SHA-256: 4e8397d06cb260120aad12c1521071215ce04f17f3de5ab8280413dc5796ed2c

220 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1137.001 Office Application Build

The sample is an OLE document containing an embedded PE executable. Heuristics indicate the presence of Ole10Native, a mechanism often used to drop and execute payloads. The document body does not contain malicious content, suggesting the primary malicious function is within the embedded executable.

Heuristics 5

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00016c04.exe`	embedded-pe	Office MZ+PE at offset 0x16C04	89084 bytes
SHA-256: `cf47a48fee19886a7002acdb6b2f9b19d51b7c91ab8fe27dda7ba8a784385ba1`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_987328956/Ole10Native	41580 bytes
SHA-256: `3bbeb45539fe2f8b3b8ab4682cee3ac06ad6530650757e259b8accb8ed0952c8`

Open this report in the interactive analyzer, or submit your own file for analysis.