Malicious Office (OLE) — malware analysis report

Heuristics 7

• CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244
  Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
• PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family critical CVE likely PPT_BINARY_MEMORY_CORRUPTION_PAYLOAD
  A macro-free binary PowerPoint (.ppt) document carries a native code payload (embedded PE and/or process-injection shellcode), staged in an oversized binary stream. Legitimate presentations do not embed executables or shellcode; this is the payload half of a PowerPoint memory-corruption exploit (CVE-2011-1269 / MS11-036 family; the same record-overflow delivery is shared with CVE-2010-2572 and CVE-2009-0556).
• Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
  OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is related Office object-delivery evidence when paired with exploit payload anomalies, but the malformed graphics record required for exact CVE attribution is not proven by this rule alone.
• ClamAV: Win.Trojan.Poison-4232 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Poison-4232
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• PEB access via FS segment (x86) high SC_PEB_ACCESS
  PEB access via FS segment (x86)
  Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'mov' is 56% of instructions — a sled or padding/filler run, not program logic).
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 236,032 bytes but its declared streams total only 40,506 bytes — 195,526 bytes (83%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Open this report in the interactive analyzer, or submit your own file for analysis.