PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family

A binary PowerPoint 97-2003 (.ppt) document with no VBA macros that carries an embedded PE and/or process-injection shellcode (PEB+API-hash resolver, WriteProcessMemory/CreateRemoteThread), or an XOR-encoded payload alongside execution-API strings, staged in an oversized binary stream (Pictures, a numbered *Table). Legitimate presentations never embed executables or shellcode; this is the payload half of a PowerPoint memory-corruption exploit. Attributed to the CVE-2011-1269 / MS11-036 family (the same record-overflow delivery is shared with CVE-2010-2572 and CVE-2009-0556, so the exact CVE is not narrowed statically). The malformed-record trigger itself is not used as the signal because the PowerPoint persist-object directory makes naive record walks unreliable.