Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5e6481efec8480b3…

MALICIOUS

Office (OLE)

943.0 KB Created: 2002-10-10 08:54:00 Authoring application: Microsoft Word 8.0 First seen: 2018-01-08
MD5: fcc59824b2299f23a21b6227397de65a SHA-1: 0861e8c025f9bab17046089f972310ed2172d7ca SHA-256: 5e6481efec8480b3d89301f43715569d2c3433b1c1e028ca6f6a22b11f9a7672
420 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1137.001 Software Deployment: Boot or Logon Initialization Scripts T1203 Exploitation for Client Execution

The sample is an OLE document containing an embedded PE executable and a legacy Flash object. The presence of Ole10Native packaging indicates an attempt to auto-execute a dropped payload, likely an executable file. The document body's German text, 'Achtung: Nach dem starten der *.exe das T-Shirt vorsichtig mit der Maus berühren (und ruhig bleiben). EINBETTEN Package', translates to 'Attention: After starting the *.exe, carefully touch the T-shirt with the mouse (and stay calm). EMBEDDED Package', which is nonsensical and likely a lure to encourage execution of the embedded file.

Heuristics 9

  • Legacy Flash object embedded in Office document high CVE related OFFICE_LEGACY_SWF_OBJECT
    Office document embeds a ShockwaveFlash ActiveX object with a legacy SWF version (5). This is old Flash-in-Office exploit-family evidence, not a specific Flash CVE without SWF tag-level validation.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Embedded Adobe Flash (SWF) in OLE document critical OFFICE_EMBEDDED_SWF
    Document contains an embedded Adobe Flash (SWF) object. Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00004a54.exe embedded-pe Office MZ+PE at offset 0x4A54 946604 bytes
SHA-256: 96a8660920340c624635aa15cc1343a9285821be2f474fc70a6b474159089367
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_1093778926/Ole10Native 943524 bytes
SHA-256: c4a5a41f0a47e1c90c40b0828d8c169642da3a6aebc83e270b4a3dfc1c51c1de

Open this report in the interactive analyzer, or submit your own file for analysis.