Office (OOXML) / .DOCX malware analysis — malicious · eebf8bbabc8d107c

MALICIOUS

Office (OOXML) / .DOCX

223.2 KB Created: 2021-04-18 19:39:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: fc3fc931e603a6c18c6d8f339b08f765 SHA-1: 383eeb03b7bd3209222205f703e5f3a2c57ba660 SHA-256: eebf8bbabc8d107c292f0d94b2ae8e40027313e38be52c9a760551e92633d577

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a malicious OOXML document that leverages an altChunk to import an RTF object. This RTF object contains OLE objects and is configured to trigger an update via \objupdate, exploiting CVE-2026-21514, a Word/OLE security bypass. This mechanism allows for the execution of arbitrary code, likely to download and run a second-stage payload. The specific exploit and RTF injection technique point to a sophisticated delivery method.

Heuristics 6

CVE-2026-21514 — Word/OLE security bypass in RTF high CVE likely CVE_2026_21514

(in altChunk RTF word/nally.rtf) RTF contains a hidden \svb hex package with DrsE2oDoc and downRevStg drawing compatibility parts. This matches an observed CVE-2026-21514 exploitation shape that manipulates Word's internal document structure and trust decisions.
altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF

Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
\objupdate forces OLE activation high RTF_OBJUPDATE

(in altChunk RTF word/nally.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

(in altChunk RTF word/nally.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

(in altChunk RTF word/nally.rtf) RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000af79f.bin` `91eaab112e8a0cbd93fb7288abc8b91f5570d1436e8a515ca886d7bf5d6e12e8`	rtf-objdata-decoded	RTF \objdata at offset 0xAF79F	84869 bytes
`objdata_01_off000e8266.bin` `31d0b0c8736350c29d658081251eef2ad4e59509fe8222d5a28340dc0162ca79`	rtf-objdata-decoded	RTF \objdata at offset 0xE8266	583987 bytes
`rtf_svb_00000009.zip` `28fc295dafc0bcccd998d6dc34a4e9ae47eb34cb74cb4b892eb6454833467799`	rtf-svb-package	RTF \svb hex-decoded ZIP at offset 0x9	116932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.