Office (OLE) / .DOC malware analysis — malicious · 7eac30f4ebad786a

MALICIOUS

Office (OLE) / .DOC

438.0 KB Created: 2010-07-27 07:00:00 Authoring application: Microsoft Office Word

MD5: 2b1094512a341715c45c8fc701d82315 SHA-1: d289e5376c21eee5b40e2e4596c75b95e983ca36 SHA-256: 7eac30f4ebad786a6c0a558fffc580635f186765abf842eb688cbcd720163ff6

108 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious Link/Object: User Execution: Malicious Link

The document contains text that appears to be a 'Deed of Pledge' related to a loan agreement, suggesting a financial scam lure. The presence of Ole10Native suggests exploitation of CVE-2026-21514, a known vulnerability in OLE objects. References to WinExec and VirtualAlloc APIs indicate the execution of malicious code, likely related to the exploitation of the OLE vulnerability to download and execute a payload. No scripts were extracted from this sample.

Heuristics 4

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `94cdd1a2d17a35a9d73b961996db77438b9b05e55813931f75bbd7aab9465d28`	ole-package	OLE Ole10Native stream: ObjectPool/_1004728125/Ole10Native	41580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.