Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 efb609d20da35026…

MALICIOUS

Office (OLE) / .DOCX

901.0 KB Created: 2021-07-06 12:08:00 Authoring application: Microsoft Office Word
MD5: 14c3183c610cad3bc1bb5bb8fc78c2d3 SHA-1: 73bbe31453df465a8adb05d22a40149de702f9a9 SHA-256: efb609d20da350260b06bde4f21813eb6d6fc7f71a675bb5b0609b6aebe44df7
602 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer T1071.001 Web Protocols T1059.003 Windows Command Shell

The sample contains VBA macros that execute upon document opening, utilizing ShellExecuteA to run a payload. It also embeds a PE executable and references Windows API functions like CreateProcess, VirtualProtect, LoadLibrary, and GetProcAddress, indicating a sophisticated execution chain. The Document_Open macro attempts to download and execute a DLL, suggesting it acts as a downloader for a second-stage payload.

Heuristics 16

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
    Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Trojan.Generic-9876346-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Generic-9876346-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e71d307f9d10461ac01ffd83b84bd3b183b6ceb16528afc94404f1086c39a1ab		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2990 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
embedded_office_0008ec71.exe
fc1f9739dc9d6e9c61222beb9e3552bbc9a5a94699eb48aafeb6491a404e8ad4		 embedded-pe Office MZ+PE at offset 0x8EC71 337807 bytes
Detection
ClamAV: Win.Trojan.Injectorx-9876306-0
Obfuscation or payload: unlikely
ole10native_00.bin
47bef3c776b96d7b6c03dd3cb82500b32f8c67215f3ea11e1216ba4cec33d2a4		 ole-package OLE Ole10Native stream: ObjectPool/_1687053522/Ole10Native 298805 bytes
Detection
ClamAV: Win.Trojan.Generic-9876346-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.