Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 71664b7a12d4c194…

MALICIOUS

Office (OOXML)

26.5 KB Created: 2017-12-04 15:11:00 UTC Authoring application: LibreOffice/5.4.2.2.0$Linux_x86 LibreOffice_project/40m0$Build-2 First seen: 2017-12-24
MD5: 69b6821f5706100c682839a5b763425b SHA-1: 5626248f3255c28d55c957cc3f89c3b034a79b93 SHA-256: 71664b7a12d4c1948ef2062c182211167f2fa011b493f197b023c04de3665dd1
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document uses a fake invoice lure to trick the user into enabling editing and opening an embedded OLE object. This object, identified as Ole10Native with executable indicators, is likely designed to exploit CVE-2026-21514 and download a second-stage payload from the URL https://corporateplatform.info/changelog.php. The embedded object and the lure strongly suggest a malicious intent to execute arbitrary code.

Heuristics 8

  • OOXML Ole10Native with payload/link indicators — possible CVE-2026-21514 high CVE likely CVE_2026_21514
    Office document contains embedded OLE (word/embeddings/oleObject2.bin) with Ole10Native plus executable, PE, or risky remote-link indicators. This is a likely CVE-2026-21514 exploitation shape.
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: http://eway.ca/
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://corporateplatform.info/changelog.php In document text (OOXML body / shared strings)
    • http://eway.ca/Document hyperlink
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject2.bin 5120 bytes
SHA-256: e13068f97eafba58d1c0a5fc9af27c14b8952817136b48efa79168f33ba80cca
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 2860 bytes
SHA-256: 93e60a694449b6d4647a9e9278b5d64aa602173add7414926f4e7c1c83363e76
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 5120 bytes
SHA-256: 250d8d9b99660575c471e94ca7f09b18b4e4145835958a3269fce4bc35b7455c
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 2848 bytes
SHA-256: 6907befe433a7dee2c7c7a66939322b1abe3be3673b4ea73ff1efe7af86bc9fb
emf_00.emf ooxml-emf OOXML EMF part: word/media/image3.emf 4340 bytes
SHA-256: 0af9f9795ca1b579734d88e54d8f6a86efb1660de3c459b248e5adf1c0a6074b
emf_01.emf ooxml-emf OOXML EMF part: word/media/image2.emf 4336 bytes
SHA-256: c8010b5d9f0b1940536f7769722caa608980c63908437a858f33f56ac7666a7b

Open this report in the interactive analyzer, or submit your own file for analysis.