Office (OLE) malware analysis — malicious · aa8961309a4f5230

MALICIOUS

Office (OLE)

181.0 KB Created: 2018-04-20 11:12:00 Authoring application: Microsoft Office Word First seen: 2020-06-01

MD5: a22382e90c3b6f2bc6b7ba3e460c6df5 SHA-1: 8b47b680b69586c9704dc742365df94d1c9793f0 SHA-256: aa8961309a4f5230cd987b5db54ff54b3b4b7376c76a03835f188ce0eead6cbb

262 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell T1566.001 Spearphishing Attachment

The document contains a DDEAUTO entry that leverages PowerShell to download and execute a payload from the URL http://88.99.104.179:1985/win_update/upgrade. This is a common technique for delivering second-stage malware. The presence of Ole10Native and a suspicious .lnk file within the OLE package further indicates malicious intent.

Heuristics 7

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
ClamAV: Doc.Exploit.DDEautoexec-6352494-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.DDEautoexec-6352494-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://88.99.104.179:1985/win_update/upgrade In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1586990151/Ole10Native	1512 bytes
SHA-256: `50df5e28fcbf93421250485bbe10265cecdc9d64bbb404c87bcdf58d5278d4d0`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): powershell.exe, PowerShell\v1.0\powershell.exe

Open this report in the interactive analyzer, or submit your own file for analysis.