Office (OLE) malware analysis — malicious · f2ee576c70386955

MALICIOUS

Office (OLE)

570.5 KB Created: 2000-07-27 20:51:00 Authoring application: Microsoft Word 8.0 First seen: 2019-01-20

MD5: 9a38e54a96e9b6c1369ab2d1f24abc77 SHA-1: bf69e075a4b309271e8584716eb9cecb2ef22bc6 SHA-256: f2ee576c70386955fd171fb0b22e81725b45010309ae000edacd6bfcdd19d157

168 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an OLE document containing an embedded executable payload, indicated by the 'OFFICE_PACKAGE_RISKY_FILE' heuristic. The document body, disguised as technical documentation for ventilation system design software, is a lure to encourage the user to interact with the embedded malicious content. The presence of Ole10Native and references to WinExec and VirtualAlloc APIs suggest exploitation for client execution.

Heuristics 5

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1011180720/Ole10Native	41580 bytes
SHA-256: `6665d3565471bba51c3efe1358ecf334f9bb1fd2672915f315cf7db61764e6eb`

Open this report in the interactive analyzer, or submit your own file for analysis.