Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 78a38fac6e25ea3e…

MALICIOUS

Office (OLE)

88.0 KB Created: 2010-02-04 13:34:00 Authoring application: Microsoft Word 9.0
MD5: 893d9127de7d7c61f044709a05ad8ef7 SHA-1: 33eff0e8b2a99df0995bd73e1bd0ad1b84eb5f25 SHA-256: 78a38fac6e25ea3e0fb093f78c48c940a9e6da7a69048d24bbaaf97baff5be40
222 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1137.001 Office Application Build T1203 Exploitation for Client Execution

The sample is an OLE document containing an embedded PE executable, flagged as a critical risk. It also references WinExec and VirtualAlloc APIs, suggesting dynamic execution capabilities. The presence of an embedded executable and the Ole10Native package strongly indicate an attempt to deliver a secondary payload, likely an executable file, to the victim.

Heuristics 6

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gremihostterrassa.com
    • http://www.terrassa.cat/firamodernista

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_0000c204.exe
71a756534e8899280f62ec23f3e40369a895e8a3d9e6d1e336821a30961be086		 embedded-pe Office MZ+PE at offset 0xC204 40444 bytes
ole10native_00.bin
d15641a6318934c4b635225640501aa020db3d776988327debb404ce27e1b1b4		 ole-package OLE Ole10Native stream: ObjectPool/_1009867771/Ole10Native 41580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.