MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a Microsoft Word document that triggers the CVE-2006-2492 vulnerability. This exploit allows for arbitrary code execution within the context of the vulnerable Word application. No further details on the payload or delivery mechanism were extracted.
Heuristics 1
-
CVE-2006-2492 — Microsoft Word malformed object pointer exploit critical CVE likely CVE_2006_2492Word OLE document has the CVE-2006-2492-era exploit shape: malformed compound-file object pointers and an impossible WordDocument stream size drive parser divergence, while unreferenced sectors contain rotate-decoded Win32 shellcode that removes Word Resiliency/StartupItems registry keys.
Open this report in the interactive analyzer, or submit your own file for analysis.