MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a Microsoft Word 95 document that exploits CVE-2017-0261/0262 via its EPS image filter. This vulnerability allows for arbitrary code execution when the document is opened. No document body content or scripts were available for further analysis, but the heuristic firing strongly indicates a client-side exploit.
Heuristics 1
-
CVE-2017-0261/0262 — EPS image filter in OLE document critical CVE_2017_0261Document references EPSIMP32 (EPS image filter) or contains PostScript — CVE-2017-0261 and CVE-2017-0262 exploit the Windows EPS image filter to achieve arbitrary code execution; used in targeted APT campaigns
Open this report in the interactive analyzer, or submit your own file for analysis.