Office (OLE) malware analysis — malicious · a32acef64fde29fb

MALICIOUS

Office (OLE)

176.5 KB Created: 2016-03-16 11:14:00 Authoring application: Microsoft Office Word First seen: 2019-05-31

MD5: dc286636b69ad3270fdb73d51774d915 SHA-1: 4cbbc1367ea597f7dd8664d0dd13d39b7722b4e7 SHA-256: a32acef64fde29fbda3bb40e9d626a1ec3e5d01e5231898d6bd9b67f9bed239e

382 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1137.001 Office Installation: Office Application Startup T1059.005 Visual Basic T1203 Exploitation for Client Execution

This Office document contains a legacy WordBasic auto-exec marker (AutoOpen) and an embedded PE executable. The presence of Ole10Native and the embedded EXE strongly suggests the document is designed to drop and execute a malicious payload. The ClamAV detection further confirms the malicious nature of the embedded artifact.

Heuristics 8

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
ClamAV: BC.Win.Packer.Troll-14 critical CLAMAV_DETECTION

ClamAV detected this file as malware: BC.Win.Packer.Troll-14
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000624e.exe`	embedded-pe	Office MZ+PE at offset 0x624E	155570 bytes
SHA-256: `54cbf1d511c8437d390bcf7872c2724bb37efc497b3daf55d97d985f63e62763`
Detection ClamAV: BC.Win.Packer.Troll-14 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1519658304/Ole10Native	128716 bytes
SHA-256: `676712955c455d6a5e541aec6a21f12d42540b1bece5ae1dfd150dcffe28a898`
Detection ClamAV: BC.Win.Packer.Troll-14 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.