Ole10Native package payload is a download-and-execute script

OFFICE_PACKAGE_SCRIPT_DROPPER

← All detection heuristics · Office

critical OFFICE_PACKAGE_SCRIPT_DROPPER

What it means

OLE Package payload contains a script that hosts a shell, fetches a remote resource, and executes it.

Why it fires

An OLE Object Packager payload whose embedded script combines a shell host (PowerShell/WScript/mshta), a network-fetch verb (Invoke-WebRequest/Irm/certutil/http(s) URL), and an execute verb (Start-Process/ShellExecute/-outfile) is a download-and-run dropper. This is a direct user-execution delivery technique (MITRE T1204.002) and is detected on payload content, so it still fires when the package header fields are blanked or shuffled to evade extension-based checks.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS