Win.Trojan.Bifrose-7058171-0 Office (OLE) malware analysis — malicious · 998f90c4aad7209c

MALICIOUS

Office (OLE)

192.0 KB Created: 2010-03-07 20:30:00 Authoring application: Microsoft Office Word

MD5: 0de9c44d1d1ea6358c6a1dd7f5210559 SHA-1: 908d7ee39970cbe63d888fdffb62c35f208b797d SHA-256: 998f90c4aad7209c9d9a518a5850ed4195621a2c3b1653eaa93c93c6fc8a34ad

262 Risk Score

Malware Insights

Win.Trojan.Bifrose-7058171-0 · confidence 95%

MITRE ATT&CK

T1559.002 Component Object Model Hijacking T1204.002 Malicious File

The file is an OLE document containing an embedded PE executable. Heuristics indicate exploitation of CVE-2026-21514 and the presence of a malicious executable. ClamAV detections confirm this is likely the Bifrose trojan. The document body contains a Spanish lure, 'EMBED Package PINCHA EN EL ICONO TESTES HAZLO Y ENVIALO A 10 PERSONAS TE TRAERA SUERTE', which translates to 'EMBED Package CLICK ON THE ICON TEST DO IT AND SEND IT TO 10 PEOPLE IT WILL BRING YOU LUCK', suggesting a social engineering tactic to trick the user into interacting with the embedded malicious content.

Heuristics 6

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
ClamAV: Win.Trojan.Bifrose-7058171-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Bifrose-7058171-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000345f.exe` `018450490f247b8a87c87873cb577543614dc009baba387d07a184289d3ff829`	embedded-pe	Office MZ+PE at offset 0x345F	183201 bytes
Detection ClamAV: Win.Trojan.Poison-30 Obfuscation or payload: unlikely
`ole10native_00.bin` `1b523bd483bc40a533e0fc2c4d414b258a3e39123941a77ed5adaec991348e16`	ole-package	OLE Ole10Native stream: ObjectPool/_1329503086/Ole10Native	178738 bytes
Detection ClamAV: Win.Trojan.Bifrose-7058171-0 Obfuscation or payload: likely Carved artifact entropy is 7.42, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.