Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 04267780dbc3b802…

MALICIOUS

Office (OLE) / .DOC

283.0 KB Created: 2001-12-14 14:26:00 Authoring application: Microsoft Word 9.0
MD5: eb99bb4595f0fd7a196f34d7817458aa SHA-1: 733c138cff1465e22e4a2843a5daff1da27753e3 SHA-256: 04267780dbc3b8026d6d3d3e56d95d3ea6a650660ab07b872fe592e7ab8f54e2
222 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter

The sample is a Microsoft Word document exhibiting a critical heuristic for CVE-2006-6456, indicating exploitation of a malformed table structure. High-severity heuristics for LoadLibrary and GetProcAddress APIs, along with an embedded PE executable, suggest the document is designed to execute malicious code. The presence of numerous unknown URLs indicates potential download locations for further stages of the attack.

Heuristics 6

  • CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456
    WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 289,792 bytes but its declared streams total only 94,801 bytes — 194,991 bytes (67%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded PE executable high OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.j-gate.informindia.co.in/
    • http://www.j-gate.informindia.co.in
    • http://www.marketlineinfo.com/corporate/login.aspx
    • http://www.hinduonnet.com/fline/archives.htm
    • http://www.himalmag.com/
    • http://www.india-seminar.com/
    • http://www.sportstaronnet.com/archives.htm
    • http://tibetan.review.to/
    • http://www.downtoearth.org.in
    • http://www.epw.org.in/epw/user/userindex.jsp
    • http://www.feer.com/
    • http://www.sla.org
    • http://www.keesings.com
    • http://www.worldaffairsjournal.com/
    • http://www.atypon-link.com/
    • http://www.atypon-link.com/AEAP/loi/app
    • http://www.atypon-link.com/AEAP/loi/pol
    • http://www.atypon-link.com/AEAP/loi/mac
    • http://www.atypon-link.com/AEAP/loi/mic
    • http://www.atypon-link.com/AEAP/loi/aer?cookieSet=1
    • http://www.atypon-link.com/AEAP/loi/jel
    • http://www.atypon-link.com/AEAP/loi/jep
    • http://www.sagefulltext.com/
    • http://mq.dukejournals.org/
    • http://pcquest.ciol.com/
    • http://www.ftchinaconfidential.com/issue/20090806
    • http://www.eiu.com/
    • http://www.jstor.org/
    • http://businesstoday.intoday.in/index.php?latn=1
    • http://indiatoday.intoday.in/index.php?option=com_wrapper&page=archives&issueid=115&Itemid=168
    • http://week.manoramaonline.com/cgi-bin/MMOnline.dll/portal/ep/home.do?tabId=13
    • http://www.economist.com/
    • http://www.ingentaconnect.com/content/paaf/paaf
    • http://www.janes.com/
    • http://www.janes.com
    • http://client.janes.com/MyAccount/index?com=siteUrlRedirect&acro=JTSM
    • http://aas.sagepub.com/
    • http://apr.sagepub.com/
    • http://arp.sagepub.com/
    • http://ann.sagepub.com/
    • http://afs.sagepub.com/
    • http://chr.sagepub.com/
    • http://cps.sagepub.com/
    • http://cac.sagepub.com/
    • http://eep.sagepub.com/
    • http://ejt.sagepub.com/
    • http://ept.sagepub.com/
    • http://eup.sagepub.com/
    • http://ips.sagepub.com/
    • http://ire.sagepub.com/
    +79 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.