Office (OLE) malware analysis — malicious · d14cc963a45bacc0

MALICIOUS

Office (OLE)

499.5 KB Created: 2004-12-06 10:21:00 Authoring application: Microsoft Office Word First seen: 2018-02-07

MD5: 352d978f16d99efbc7db88446241ca17 SHA-1: 7b52343e0f0e44bddd30db221b6b088a65e28491 SHA-256: d14cc963a45bacc083457948d30f7d66f17fc183f256617ccff8e6f2fe5bd5b4

382 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a Microsoft Word document containing an embedded executable file (MZ header detected). Heuristics indicate exploitation of CVE-2007-3899 and the presence of Ole10Native, suggesting a method for dropping and executing a payload. The document body text encourages the user to 'Double click the Icon below', which refers to the embedded executable, likely leading to client execution via exploitation.

Heuristics 9

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00003e67.exe`	embedded-pe	Office MZ+PE at offset 0x3E67	495513 bytes
SHA-256: `598f5a5feb012f1bb475dc697a32495a60ecc12e91001dcb40f32d66d0be38eb`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1131442430/Ole10Native	482714 bytes
SHA-256: `6c02c346e500c40ca665a10b2c32ce9524cf224c35658e5e965d5fe5efc62faa`

Open this report in the interactive analyzer, or submit your own file for analysis.