Office (OLE) / .DOC malware analysis — malicious · a4bfbe3cb85f11fe

MALICIOUS

Office (OLE) / .DOC

151.0 KB Created: 2008-08-14 06:22:00 Authoring application: Microsoft Office Word

MD5: fa0dd46895db3a78588620de4bfc3172 SHA-1: a46b41c78e7b850fd62d418b05d03cae29c272f9 SHA-256: a4bfbe3cb85f11fe0185c548bac38c969023631444b9c4857c790bd8aff95565

100 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The sample is a malicious OLE document that contains an embedded OLE package. Heuristics indicate a high likelihood of exploitation for CVE_2026_21514, which is a known vulnerability in OLE objects. The presence of WinExec and VirtualAlloc API references suggests the execution of malicious code. No scripts were extracted from this sample.

Heuristics 4

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `6d0c0563a82dc7cca4477d32b8a6745be51acdf03e995bf3bf5895fe82c716ef`	ole-package	OLE Ole10Native stream: ObjectPool/_1011169924/Ole10Native	41580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.