Office (OLE) / .DOC malware analysis — malicious · c5f27cec21e56d45

MALICIOUS

Office (OLE) / .DOC

106.0 KB Created: 2010-03-31 08:37:00 Authoring application: Microsoft Word 10.0

MD5: 9ef74987bcf2ab74565f95e2efafe034 SHA-1: 209f2a42bd9e7baa39d432f9bf9f6f581e465795 SHA-256: c5f27cec21e56d4571f08502d7ae947d5fffac1e10fed61a659b571725cdd51b

302 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1137.001 DLL Search Order Hijacking T1059.001 PowerShell

The file is a Microsoft Word document containing an embedded PE executable. Heuristics indicate potential exploitation of CVE-2026-21514 via Ole10Native, and references to LoadLibrary and GetProcAddress suggest dynamic library loading, common in malware. The embedded executable itself was detected by ClamAV as Win.Trojan.Trojan-410. The document body simply states 'EMBED Package', further indicating a lure to execute the embedded malicious payload.

Heuristics 7

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
ClamAV: Win.Trojan.Trojan-410 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Trojan-410
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00003075.exe` `21afa00504948e95acb667fbc9ee5112fefee529e410a6445e951ab73044173c`	embedded-pe	Office MZ+PE at offset 0x3075	96139 bytes
Detection ClamAV: Win.Trojan.Trojan-410 Obfuscation or payload: likely Carved artifact entropy is 7.82, consistent with packed or encrypted content.
`ole10native_00.bin` `714be8f6bd7f9c8d90ed60abfefb745f591f0ad51a8e02592e4c000f8d5c47a7`	ole-package	OLE Ole10Native stream: ObjectPool/_1331536965/Ole10Native	92993 bytes
Detection ClamAV: Win.Trojan.Trojan-410 Obfuscation or payload: likely Carved artifact entropy is 7.90, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.