Office (OLE) malware analysis — malicious · 7b784ace81e68bab

MALICIOUS

Office (OLE)

149.0 KB Created: 2010-07-25 22:33:00 Authoring application: Microsoft Office Word

MD5: 0deab56f45aa666568808f02c90d32fb SHA-1: 14893f23f1bcd0c99aa62a8577c048c439617175 SHA-256: 7b784ace81e68bab0eb5610056f7dd62a005ba18a3534e87c71b95e88b389723

322 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious due to the presence of an Ole10Native package, which is flagged for dropping an auto-executable payload. Heuristics indicate references to WinExec, VirtualAlloc, and LoadLibrary APIs, suggesting code execution capabilities. The ClamAV detection further confirms its malicious nature, classifying it as Doc.Trojan.Beast-11. The embedded artifact 'ole10native_00.bin' is the primary IOC.

Heuristics 8

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
ClamAV: Doc.Trojan.Beast-11 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Beast-11
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `1ee710061e82b935590d69cbfa92f4a1d771557894509d1d9826d0fb320271ab`	ole-package	OLE Ole10Native stream: ObjectPool/_1236684797/Ole10Native	56428 bytes
Detection ClamAV: Doc.Trojan.Beast-11 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.