Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 d406cd8fedf892fa…

MALICIOUS

Office (OLE) / .DOC

1.20 MB Created: 2003-06-19 18:39:00 Authoring application: Microsoft Word 9.0
MD5: 6bf09de4cab69a1772f52879338a55da SHA-1: 659f892cd587ce96467dda2d3a1151d9b0089711 SHA-256: d406cd8fedf892fa25b52e3d96b9e4b15c9b3907b4161916e793dd7c6f13f525
260 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1059.001 PowerShell T1059.003 Windows Command Shell

The file is a Microsoft Word document that leverages an OLE object to exploit CVE-2026-21514, a known vulnerability. Heuristics indicate the use of WinExec, VirtualAlloc, and LoadLibrary APIs, suggesting the execution of malicious code. ClamAV detection confirms this as Doc.Trojan.Beast-11, a known malware. The embedded URL is likely part of the delivery or command and control infrastructure.

Heuristics 7

  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • ClamAV: Doc.Trojan.Beast-11 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Beast-11
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ind.com.gov.au

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ole10native_00.bin
1c126f183e84a614db4f529f778ed8aabcf969be81a65a1ad035341efcdea946		 ole-package OLE Ole10Native stream: ObjectPool/_983172257/Ole10Native 71588 bytes
ole10native_01.bin
355847bda5ddbb23f94afc6656e447630c3f1e88bf73292ffcd17ee9488a66d1		 ole-package OLE Ole10Native stream: ObjectPool/_983172259/Ole10Native 510628 bytes
ole10native_02.bin
38e776c8e03fcaffee1809e0b5de0d827a9543961bfa839f1b86c64109d7e1b4		 ole-package OLE Ole10Native stream: ObjectPool/_983172411/Ole10Native 56428 bytes
Detection
ClamAV: Doc.Trojan.Beast-11
Obfuscation or payload: unlikely
ole10native_03.bin
7b1b0fb7442b192524dea1980437506db95a0e614356f0a1808a7d09702b6c48		 ole-package OLE Ole10Native stream: ObjectPool/_983176377/Ole10Native 56420 bytes
Detection
ClamAV: Doc.Trojan.Beast-11
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.