MALICIOUS
382
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is a malicious Office document exploiting CVE-2007-3899 to execute shellcode. It contains an embedded PE executable and prompts the user to click a link, indicating a downloader or dropper functionality. The embedded executable and the document's lure suggest it's part of a phishing campaign.
Heuristics 8
-
CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
-
ClamAV: Win.Downloader.24465-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Downloader.24465-1
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)Disassembly hidden — these bytes score as data, not coherent x86 code (3/14 branch targets land on an instruction boundary (21% coherence)).
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)Disassembly hidden — these bytes score as data, not coherent x86 code (3/9 branch targets land on an instruction boundary (33% coherence)).
-
OLE file contains raw shellcode-like resolver payload high OLE_RAW_SHELLCODE_PAYLOADMalformed or legacy OLE file contains raw PEB/API-resolver shellcode bytes at the file level, including loader-walk instructions and a nearby payload marker. This indicates an exploit payload carrier but does not identify a specific parser CVE.Disassembly hidden — these bytes score as data, not coherent x86 code (3/9 branch targets land on an instruction boundary (33% coherence)).
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_00002e79.exe |
embedded-pe | Office MZ+PE at offset 0x2E79 | 20871 bytes |
SHA-256: d056f52096795dec486e98be941c5ccefd3e1c8d7c31a3b53b09e39bad8431fe |
|||
|
Detection
ClamAV:
Win.Downloader.25476-1
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_GETPC_CALL, SC_GETPC_CALL
|
|||
ole10native_00.bin |
ole-package | OLE Ole10Native stream: ObjectPool/_1334602803/Ole10Native | 12411 bytes |
SHA-256: ab71eef51c6adf8532fc9c5497488a961b1a91a6f1965c65b824e7d0b248fe49 |
|||
|
Detection
ClamAV:
Win.Downloader.24465-1
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_GETPC_CALL, SC_GETPC_CALL
|
|||
ole10native_00_PRIVATO |
ole-package-payload | OLE Ole10Native payload: ObjectPool/_1334602803/Ole10Native; display_name=PRIVATO; full_path=K:\H.A.C.K.E.R\POISON\AEREO X.exe; temp_path=; def_file= | 12288 bytes |
SHA-256: 1482f62f8032838bc1ec6fe40b924067a685a764287400cf3b8caf0da61ca86d |
|||
|
Detection
ClamAV:
Win.Downloader.25476-1
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_GETPC_CALL, SC_GETPC_CALL
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.