Office (OLE) / .DOC malware analysis — malicious · 7e8c150ef4af5a28

MALICIOUS

Office (OLE) / .DOC

106.0 KB Created: 2010-05-03 11:23:00 Authoring application: Microsoft Word 10.0

MD5: a7f6735a4c6da6468fefb5c4b93f6830 SHA-1: 20b09746efd79f312727be59d373e90ea8ede793 SHA-256: 7e8c150ef4af5a286e33eaa1bdbedfbc756501fa3778fb1472945858733de825

302 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking

The file is an OLE document containing an embedded PE executable. Heuristics indicate potential exploitation of CVE-2026-21514 via Ole10Native, and the embedded executable was detected by ClamAV as Win.Trojan.Trojan-410. The document body simply states 'EMBED Package', which is a common lure to encourage users to open the embedded malicious content.

Heuristics 7

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
ClamAV: Win.Trojan.Trojan-410 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Trojan-410
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00003073.exe` `533a7665f05c71f24e1809bb4715db5ef6bdc540e942cc0b2ccd72b266634081`	embedded-pe	Office MZ+PE at offset 0x3073	96141 bytes
Detection ClamAV: Win.Trojan.Trojan-410 Obfuscation or payload: likely Carved artifact entropy is 7.82, consistent with packed or encrypted content.
`ole10native_00.bin` `c3889378bf061624f8fd908ba628c773e4e3bdf3142030f5c277b02fd3e63b7f`	ole-package	OLE Ole10Native stream: ObjectPool/_1334398274/Ole10Native	92987 bytes
Detection ClamAV: Win.Trojan.Trojan-410 Obfuscation or payload: likely Carved artifact entropy is 7.90, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.