---
title: "OLE Package – The Attachment That Installs: How a Program Hides Behind a Document Icon"
description: A program behind a document icon inside an Outlook message runs with one double-click. Sandworm used Package objects against Ukraine.
---

[File Security 101 - Threats Beyond Malware explained](https://explore.bowbridge.net/file-security-101)

# [OLE Package – The Attachment That Installs: How a Program Hides Behind a Document Icon](https://explore.bowbridge.net/file-security-101/episode-3-ole-package-the-attachment-that-installs)

 Written by [Joerg Schneider-Simon](https://explore.bowbridge.net/file-security-101/author/joerg-schneider-simon) | Nov 11, 2026, 12:00:00 PM

An Outlook message can carry a program that looks exactly like a PDF or a Word document, and a single double-click starts it. This is episode 3 of File Security 101, our series on file-based threats your anti-malware does not see.

The video explains it in about two minutes.  
 The article adds the details and the research behind it.

## An attachment that looks like a document

The message arrives as an Outlook item, a `.msg` file, for example forwarded as an attachment or saved from another mailbox. Inside is an attachment with a document icon and a name such as `Invoice-2291.pdf`. Nothing about it looks different from the files people open every day.

## OLE: a file inside a file

OLE, short for Object Linking and Embedding, is the Windows technology that lets one document carry another: a spreadsheet inside a slide, a chart inside a report. An OLE object brings its data and a picture of itself, which the host application shows in place of the object. In an Outlook message, an attachment can be such an OLE object; the message format marks it with the attachment method value 6, and the picture Outlook draws for it is stored in a separate property as a Windows metafile ([Microsoft](https://learn.microsoft.com/en-us/office/client-developer/outlook/mapi/pidtagattachrendering-canonical-property)).

One OLE class, called Package, exists to wrap files that have no OLE support of their own. A Package can hold any file, programs and scripts included, with a label and an icon that the sender chooses. The icon is only a picture. It says nothing about what the package contains.

## The attack: a program in disguise

The attacker wraps a program in a Package, gives it a PDF or Word icon and a label like an invoice, and sends it. When the recipient double-clicks it, the Windows packager writes the embedded file to a temporary folder and opens it with the program Windows associates with its type. For an executable, that means it runs, with the user's rights. Typically it installs the attacker's actual malware, and from then on the attacker can work on that computer as the user.

In July 2015, security researcher Kevin Beaumont warned that the packager lets executables and scripts be embedded in Office documents, that attackers were experimenting with it, and that users can click through the warnings shown before such objects run, which most do ([Help Net Security](https://www.helpnetsecurity.com/2015/07/06/old-ms-office-feature-can-be-exploited-to-deliver-execute-malware/)).

## It happened

In October 2014, iSIGHT Partners reported a cyber-espionage campaign by a group it called Sandworm and linked to Russia. Spear-phishing mails to the Ukrainian government and at least one U.S. organization carried PowerPoint files whose Package objects referenced files on a remote server; the packager downloaded them, and an INF file renamed and started the BlackEnergy trojan ([PCWorld](https://www.pcworld.com/article/435818/russian-hackers-exploit-windows-zeroday-flaw-to-target-ukraine-us-organizations.html), [Zscaler](https://www.zscaler.com/blogs/security-research/analysis-sandworm-cve-2014-4114-0-day)). Microsoft fixed the flaw on October 14, 2014, as [CVE-2014-4114](https://nvd.nist.gov/vuln/detail/CVE-2014-4114) in bulletin [MS14-060](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060). It is on CISA's Known Exploited Vulnerabilities list.

OLE has been abused through other object types as well. In April 2017, FireEye described Word documents with an embedded OLE2 link object: on opening, Word fetched an HTA file from a remote server and Windows ran the script in it, which installed malware such as LATENTBOT ([FireEye, now Google Cloud](https://cloud.google.com/blog/topics/threat-intelligence/cve-2017-0199-hta-handler/)). That flaw, [CVE-2017-0199](https://nvd.nist.gov/vuln/detail/CVE-2017-0199), is also on CISA's Known Exploited Vulnerabilities list.

## Why it slips through

This attachment does carry malware, and it still gets through, for structural reasons. A filter that blocks dangerous file types sees an Outlook message, not a program. The program sits several layers down: inside an OLE object, inside an attachment, inside the message, and every layer must be unpacked before anything can look at it. Attackers also rebuild and repack their programs often, so a scanner that does reach the program may not recognize the new variant yet.

## What to do

- Do not open packaged files you did not expect, whatever their icon or name. If in doubt, ask the sender through another channel.
- In Microsoft 365, Word, Excel, PowerPoint, Visio and Publisher block packaged objects of high-risk types by default. Administrators can go further with the `PackagerPrompt` value under `HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\<application>\Security`: the value 2 means packaged objects never run ([Microsoft](https://support.microsoft.com/en-us/office/packager-activation-in-office-365-desktop-applications-52808039-4a7c-4550-be3a-869dd338d834)).
- Make sure your mail security unpacks Outlook messages and their embedded objects, not only the outer file.

bowbridge Content Disarm and Reconstruct rebuilds an Outlook message from its headers, its text and its regular attachments, each rebuilt by the rules for its own format. OLE package attachments are not carried over, so the program behind the document icon does not reach the recipient.

[Join the bowbridge CDR beta program](https://explore.bowbridge.net/en/cdr-beta)

## Sources

- [Russian hackers exploit Windows zero-day flaw to target Ukraine, U.S. organizations](https://www.pcworld.com/article/435818/russian-hackers-exploit-windows-zeroday-flaw-to-target-ukraine-us-organizations.html), PCWorld, October 14, 2014
- [Analysis of Sandworm CVE-2014-4114 0-day](https://www.zscaler.com/blogs/security-research/analysis-sandworm-cve-2014-4114-0-day), Zscaler, October 14, 2014
- [MS14-060: Vulnerability in Windows OLE could allow remote code execution](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060), Microsoft, October 14, 2014
- [CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler](https://cloud.google.com/blog/topics/threat-intelligence/cve-2017-0199-hta-handler/), FireEye (now Mandiant, Google Cloud Blog), April 11, 2017
- [Packager activation in Office 365 desktop applications](https://support.microsoft.com/en-us/office/packager-activation-in-office-365-desktop-applications-52808039-4a7c-4550-be3a-869dd338d834), Microsoft Support
- [PidTagAttachRendering canonical property](https://learn.microsoft.com/en-us/office/client-developer/outlook/mapi/pidtagattachrendering-canonical-property), Microsoft Learn
- [Old MS Office feature can be exploited to deliver, execute malware](https://www.helpnetsecurity.com/2015/07/06/old-ms-office-feature-can-be-exploited-to-deliver-execute-malware/), Help Net Security, July 6, 2015

## Subscribe to upcoming episodes

[View full post](https://explore.bowbridge.net/file-security-101/episode-3-ole-package-the-attachment-that-installs)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Joerg Schneider-Simon"
  },
  "dateModified" : "2026-11-11T13:07:11.565Z",
  "datePublished" : "2026-11-11T12:00:00Z",
  "headline" : "OLE Package – The Attachment That Installs: How a Program Hides Behind a Document Icon",
  "image" : {
    "@type" : "ImageObject",
    "height" : 500,
    "url" : "https://2773339.fs1.hubspotusercontent-eu1.net/hubfs/2773339/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg",
    "width" : 1779
  },
  "mainEntityOfPage" : "https://explore.bowbridge.net/file-security-101/episode-3-ole-package-the-attachment-that-installs",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "File Security 101 - Threats Beyond Malware explained"
  }
}
```