Office (OLE) / .DOC malware analysis — malicious · a96fb830f8379930

MALICIOUS

Office (OLE) / .DOC

151.0 KB Created: 2008-08-14 06:22:00 Authoring application: Microsoft Office Word

MD5: 29dbb3fb53dbf8ec6b97c258e9c5e95c SHA-1: 61826933d560d9a6755e655cd45d357f547aa317 SHA-256: a96fb830f8379930fbcd000c65626f88ed805448a09160939b3175d28a1a7dbb

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter

The sample is a malicious OLE document that leverages the Ole10Native object, strongly indicating exploitation of CVE-2026-21514. The presence of WinExec and VirtualAlloc API references suggests the execution of arbitrary code. The embedded OLE package is likely the payload delivery mechanism.

Heuristics 4

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `6d0c0563a82dc7cca4477d32b8a6745be51acdf03e995bf3bf5895fe82c716ef`	ole-package	OLE Ole10Native stream: ObjectPool/_1011169924/Ole10Native	41580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.