Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 687f7bba20b525b3…

MALICIOUS

Office (OLE) / .DOC

413.0 KB Created: 2020-11-30 17:19:00 Authoring application: Microsoft Office Word
MD5: 28ab184b90b90e55e154e718eaf4cc1f SHA-1: 5bb65876198d309fe394bb9b313cca4403208478 SHA-256: 687f7bba20b525b3e93a52ecf1d816e34521a476197616a6b1b2dd3a6c5990c3
722 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.005 Visual Basic T1105 Ingress Tool Transfer T1203 Exploitation for Client Execution

The sample is a malicious Microsoft Word document that exploits CVE-2007-3899 to execute an embedded PE executable. The AutoOpen VBA macro contains calls to ShellExecute and CreateObject, indicating it's designed to launch the embedded payload. The embedded executable was detected by ClamAV as Win.Keylogger.Cridex-9807692-0, suggesting a keylogging or information-stealing purpose.

Heuristics 18

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Doc.Dropper.Hancitor-9845854-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Hancitor-9845854-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
7fba07bccdec597d54e9f78d7130bb86f40a31d08e87f1b5bbf0309a89496c99		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3485 bytes
embedded_office_00021a71.exe
d96f07bc7e0fe1e194e7909d5937a3153e1aa262566859e77db3484a8d6a8b42		 embedded-pe Office MZ+PE at offset 0x21A71 285071 bytes
Detection
ClamAV: Win.Keylogger.Cridex-9807692-0
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
ole10native_00.bin
7adcf0e7f1022ac61e0b147a9b5a3aada9d90a9dc787d81c4b9421c29c54322a		 ole-package OLE Ole10Native stream: ObjectPool/_1668240359/Ole10Native 237877 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.