Office (OLE) malware analysis — malicious · 5e0697e5bd864693

MALICIOUS

Office (OLE)

724.0 KB Created: 2004-12-28 06:49:00 Authoring application: Microsoft Word 9.0 First seen: 2019-09-30

MD5: d6d849b0e6e3575f3792d99361ec3e1f SHA-1: 34ddc35153b0f516e599e2a198f1e0e26067aff8 SHA-256: 5e0697e5bd8646936cd9aa4d1d69605ac44cd2bf41abac0b3805e44be4b06647

422 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1134.001 Access Token Manipulation: Token Impersonation/Theft T1203 Exploitation for Client Execution

The file is an OLE document containing an embedded PE executable and a Flash object, indicating it's designed to drop and execute malicious payloads. Heuristics suggest exploitation of CVE-2026-21514 and the use of WinExec, CreateProcess, LoadLibrary, and GetProcAddress APIs, common in malware execution. The embedded executable and Ole10Native package are the primary indicators of malicious intent.

Heuristics 10

Legacy Flash object embedded in Office document high CVE related OFFICE_LEGACY_SWF_OBJECT

Office document embeds a ShockwaveFlash ActiveX object with a legacy SWF version (5). This is old Flash-in-Office exploit-family evidence, not a specific Flash CVE without SWF tag-level validation.
OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Embedded Adobe Flash (SWF) in OLE document critical OFFICE_EMBEDDED_SWF

Document contains an embedded Adobe Flash (SWF) object. Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://friendship.icq.com In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00004459.exe`	embedded-pe	Office MZ+PE at offset 0x4459	723879 bytes
SHA-256: `f4f657ce5ec9f2a17d7e2204eb4ff5d55de76a20f7aa3e21d9e20c59e63b4fbb`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1165725347/Ole10Native	720406 bytes
SHA-256: `4644e12d732070b24458bc382f8ad1415cdaee453b09b21661ad9ae4deb356c7`

Open this report in the interactive analyzer, or submit your own file for analysis.