Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 8bf91ee9796419a5…

MALICIOUS

Office (OLE) / .DOC

924.5 KB Created: 2021-06-17 07:22:00 Authoring application: Microsoft Office Word
MD5: 2e9d26b62238bcac9ba6798f8a22ac98 SHA-1: 8b1bf7fa08e3571bd8c024209b0d06240b6eca9c SHA-256: 8bf91ee9796419a5aeea1f27ecf8f10b0c8fcac3ab335e51c3e284ccc0527d2d
682 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 User Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic for Applications T1218.002 System Binary Proxy Execution: Rundll32

The Document_Open macro executes a sequence that drops a file named 'kikus.dll' into the user templates path and executes it using the reconstructed command 'rundll32' with the 'kikus.dll,GBSLWSDVGOE' argument. The sample also contains an embedded PE executable and an Ole10Native package, which the macro's 'yyy' subroutine likely interacts with to extract the payload. ClamAV has flagged the embedded artifact as Win.Packed.Midie.

Heuristics 18

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Packed.Midie-10008727-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Packed.Midie-10008727-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
69e47c1773aef4cb1c60de9dedfff0981c3f84cd531fb1c75d08407dfed31313		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2106 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
embedded_office_0008ec71.exe
ebe527dd62fd0f32da9a8e8bff21a3eabeef3645245c27011f90c075b94965d8		 embedded-pe Office MZ+PE at offset 0x8EC71 361871 bytes
Detection
ClamAV: Win.Packed.Midie-10008727-0
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
ole10native_00.bin
f3bf81f40ca4224ac5e263ed529e634419aed9f2d5899ffd92107a59e8b1e491		 ole-package OLE Ole10Native stream: ObjectPool/_1685394545/Ole10Native 327989 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.