Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 9df29d54fb6a2a76…

MALICIOUS

Office (OLE) / .DOCX

864.0 KB Created: 2021-06-22 07:59:00 Authoring application: Microsoft Office Word
MD5: b202bf046ab1e5908545a1c9485b8633 SHA-1: 4b3269960df01e44c4f1bb54769fe0d09b8a622b SHA-256: 9df29d54fb6a2a763fcd41dee7bb3de2d6116e66f2926e0c8eb4c2ff814fe662
622 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a VBA macro, specifically a Document_Open macro, which is configured to execute code. This macro is designed to launch an embedded PE executable file. The presence of ShellExecute, LoadLibrary, and GetProcAddress API calls within the VBA code further indicates malicious intent, likely for loading and executing the embedded payload. The embedded executable itself was detected by ClamAV as Win.Trojan.Malwarex-9874388-0.

Heuristics 16

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Trojan.Malwarex-9874388-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Malwarex-9874388-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d271b1325d2e1626b5403f3c48765244b3e012139430d217da2b66e041e6c603		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2695 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
embedded_office_0008ea71.exe
026fa4c3da0a03e4575f25f9546caa530176c32b6b57662ba2dbe9bce792ba91		 embedded-pe Office MZ+PE at offset 0x8EA71 300431 bytes
Detection
ClamAV: Win.Trojan.Malwarex-9874388-0
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
ole10native_00.bin
41b0f39dc32cbe6b113f52ff2760eff3aaa1fce454bcec60657b2072610d6459		 ole-package OLE Ole10Native stream: ObjectPool/_1685828910/Ole10Native 258357 bytes
Detection
ClamAV: Win.Trojan.Malwarex-9874388-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.