Office (OLE) / .DOC malware analysis — malicious · 776f357682eab0f0

MALICIOUS

Office (OLE) / .DOC

706.0 KB Created: 2010-02-23 19:22:00 Authoring application: Microsoft Word 9.0

MD5: 15c3d7f20db721caaa51d59f59169e36 SHA-1: 7158ddead4ad9f379bd86aa7ca71d203594f01ce SHA-256: 776f357682eab0f017c457c570d6e60846ece3ca2e5148ec201c6de0fa64cf5c

262 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document is a password-protected archive lure, instructing the user to install a program disguised as 'PBrush Clique' or 'Package'. It contains an embedded PE executable, indicating it's likely a downloader or dropper for a second-stage payload. The presence of ShellExecute, LoadLibrary, and GetProcAddress API calls further suggests dynamic loading of malicious code.

Heuristics 7

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0003f2e6.exe` `47eced75089bd8f6e191225351cd9a4a144164b48782e61a3e9a4fa4a549aeb9`	embedded-pe	Office MZ+PE at offset 0x3F2E6	464154 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.85, consistent with packed or encrypted content.
`ole10native_00.bin` `6c1a29c9d3241647768975f67fc9b69dca91fcc483ac7e2f435564e898c02852`	ole-package	OLE Ole10Native stream: ObjectPool/_1328447302/Ole10Native	131716 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.48, consistent with packed or encrypted content.
`ole10native_01.bin` `68afae6f5567f122a5ccd943fe3c6bf6c0324aba767bfbfba6ac60f9ab2994dc`	ole-package	OLE Ole10Native stream: ObjectPool/_1328447917/Ole10Native	482578 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.83, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.