Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 004ba3d735ed4a85…

MALICIOUS

Office (OLE)

25.5 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel
MD5: ef3e6e629e058a27e9bff690e421a03b SHA-1: b2f0a20130c68cf215eb61cb6dc70310ab4d1e2c SHA-256: 004ba3d735ed4a85ee23e2971587e6502c0735e443a651c1f0692b133c573973
60 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a malicious Microsoft Excel file that exploits the CVE-2009-3129 vulnerability. This vulnerability allows for arbitrary code execution by overflowing a record within the Excel file structure. No further details on the payload or delivery mechanism were extracted.

Heuristics 1

  • CVE-2009-3129 — Excel FEATHEADER record overflow critical CVE exact CVE_2009_3129
    Workbook BIFF stream contains a FEATHEADER (Feature Header) record with anomalous size (record_size=23, isf=2, cbHdrData=4294967295). Legitimate FEATHEADER records are tiny (<100 bytes) and carry cbHdrData values that fit in the record body; the value here is the documented CVE-2009-3129 exploit primitive — cbHdrData drives a memcpy with attacker-controlled size, leading to memory corruption and code execution in Excel 2007/2003.

Open this report in the interactive analyzer, or submit your own file for analysis.