Office (OLE) / .DOCX malware analysis — malicious · 9ede291b890cbfd8

MALICIOUS

Office (OLE) / .DOCX

29.5 KB Created: 2013-10-02 20:47:00 Authoring application: Microsoft Office Word First seen: 2022-03-17

MD5: b90c6cf0565dc6ed2ea2a1f5d8423bbd SHA-1: 6aaa82d9d9b336022a94b327cac7ab442d610c32 SHA-256: 9ede291b890cbfd8ba296f0e9c0ba1fecee07a2db8886218d3b5afa1ab855dba

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The document contains instructions to 'Enable' content and 'Run' an embedded package, indicating a social engineering lure to execute malicious content. The presence of an Ole10Native package with a '.vbs' extension, combined with heuristics for Windows Script Host and OLE exploitation (CVE-2026-21514), strongly suggests the embedded package is a script designed to be executed. This script likely downloads and executes a second-stage payload, a common technique for initial access.

Heuristics 5

Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT

OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `d8ec9b0d38d133017b229566d23f582d5e5d595304bb5c46fa1d02281841fa94`	ole-package	OLE Ole10Native stream: ObjectPool/_1442255617/Ole10Native	556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.