Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 6de957c6676bdc84…

MALICIOUS

Office (OLE) / .DOC

1.07 MB Created: 2021-07-01 09:35:00 Authoring application: Microsoft Office Word
MD5: 392fc3d980b07be74eb27eb133ac48ae SHA-1: 4dd586156f768e02068d015f5fc3a65ce02b1406 SHA-256: 6de957c6676bdc847586662208a81e09971fbe1257a7557348d67621e63a8e5f
642 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is a malicious Microsoft Word document that exploits CVE-2007-3899 for memory corruption. The embedded VBA macro, specifically the Document_Open subroutine, attempts to download and execute a secondary payload. It constructs the command to run 'rundll32' with arguments that suggest loading a DLL from the user's template path, likely to establish persistence or download further stages. The presence of an embedded PE executable and ClamAV detections further confirm its malicious nature.

Heuristics 16

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Doc.Downloader.Jrat-6336393-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Jrat-6336393-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
9761bf3bf9c7f742d348111068acadda0e5b3c1c7b2a7a3601994e74798830bb		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2932 bytes
embedded_office_0008f271.exe
2aa3c85698b148a4b5972cbdd2fc99d36b79d2501f8664f7418c080e95b246b6		 embedded-pe Office MZ+PE at offset 0x8F271 537999 bytes
Detection
ClamAV: Win.Trojan.Injectorx-9876306-0
Obfuscation or payload: unlikely
ole10native_00.bin
cdc6ccd9484c878026307fafe8ef9f23273ecb8e6ae81251c229cd3d13938acd		 ole-package OLE Ole10Native stream: ObjectPool/_1686612394/Ole10Native 498485 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.