Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 b6367724eb1a0855…

MALICIOUS

Office (OLE) / .DOC

120.5 KB Created: 2010-03-12 18:13:00 Authoring application: Microsoft Office Word
MD5: 3969c9468768a95de1fafbfd3b5f8064 SHA-1: caa25fc72c579c79eb10822413eb236be75da81d SHA-256: b6367724eb1a0855b658cbc2c3322a57e9bca21d70e77405de85130e3599d2d6
302 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1137.001 DLL Search Order Hijacking

The sample is a malicious OLE document containing an embedded PE executable. The document body suggests a lure for opening the embedded content, likely to execute the payload. The presence of LoadLibrary and GetProcAddress API calls, along with the embedded executable and OLE_EMBEDDED_EXE heuristic, strongly indicates a malicious dropper or downloader.

Heuristics 8

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Spyware.70446-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Spyware.70446-2
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_0000307c.exe
c812e371c3e6a8c5391dfce06a717648771d3cfdfaea6628973ce7e89f95717d		 embedded-pe Office MZ+PE at offset 0x307C 110980 bytes
Detection
ClamAV: Win.Spyware.70446-2
Obfuscation or payload: likely
Carved artifact entropy is 7.73, consistent with packed or encrypted content.
ole10native_00.bin
251b3c774aad4d1b90d5db81806eff3607759c342eaf1860ab50d61a7fb6046c		 ole-package OLE Ole10Native stream: ObjectPool/_1329904803/Ole10Native 102749 bytes
Detection
ClamAV: Win.Spyware.70446-2
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.