Office (OLE) malware analysis — malicious · fdbbedfbd01da6e0

MALICIOUS

Office (OLE)

252.5 KB Created: 2016-01-21 22:06:00 Authoring application: Microsoft Office Word First seen: 2018-02-07

MD5: 227934ea7f9ed1b717071d2a9779c0d7 SHA-1: 881bef1955917ec57f8fd7e238575b1baae58d11 SHA-256: fdbbedfbd01da6e083b3a44fde8854f82d07267c841bed6f055c79583fe28379

442 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1137.001 Office Application Startup: VBA T1204.002 Malicious File Execution: Malicious File T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information

The sample is a malicious Office document containing an embedded executable (MZ header detected) and a legacy WordBasic AutoOpen macro. Heuristics indicate the use of APIs like VirtualAlloc, WriteProcessMemory, LoadLibrary, and GetProcAddress, suggesting the embedded executable is likely a loader or dropper. The document body presents a job application lure, which is a common tactic for social engineering users into opening malicious attachments. The embedded executable is the primary payload, and the macro likely facilitates its execution.

Heuristics 11

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
ClamAV: Doc.Dropper.Agent-6436248-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6436248-0
Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.joeblogs.co.uk In document text (OLE body)
- http://www.learndirect.co.ukIn document text (OLE body)
- http://www.monster.co.ukIn document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00004a6a.exe`	embedded-pe	Office MZ+PE at offset 0x4A6A	239510 bytes
SHA-256: `0ae9961ab785283fec5fe1838ea23bd31341ac6fd7397baabf445739e61c4371`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1525007934/Ole10Native	192800 bytes
SHA-256: `57ebd043be01e0c512f01db39bd587549ffaf7208ada79aee0eb5a757abce137`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.41, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.