Office (OLE) malware analysis — malicious · 1dd203933fc4e940

MALICIOUS

Office (OLE)

501.8 KB Created: 2007-08-13 02:12:00 Authoring application: Microsoft Office Word First seen: 2019-05-31

MD5: f116f348f035250722cbc4a986591f09 SHA-1: f7ae023b169f4ca4e612c993f8d2cac872a3f325 SHA-256: 1dd203933fc4e9403df4b1e4f66dca279b9e6d747fa077f8acc5ff96f9ae6058

700 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

This Office document contains critical findings indicating the exploitation of CVE-2007-3899 and CVE-2008-2244, which are used to embed and execute a PE file. The presence of CreateProcess, VirtualProtect, LoadLibrary, and CreateRemoteThread API calls further suggests malicious execution. The document body content appears to be unrelated news, likely a lure to distract from the malicious payload.

Heuristics 14

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244

Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
ClamAV: Win.Malware.Razy-9886340-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Malware.Razy-9886340-0
Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE

A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.

x86 GetPC stub (CALL $+5; POP EDX) high SC_GETPC_CALL

x86 GetPC stub (CALL $+5; POP EDX)

Disassembly

Attempted x86 opcode disassembly

0002CC72  e800000000        call 0x2cc77
0002CC77  5a                pop edx
0002CC78  ffc2              inc edx
0002CC7A  0fc0c1            xadd cl, al
0002CC7D  e800000000        call 0x2cc82
0002CC82  5a                pop edx
0002CC83  f7d2              not edx
0002CC85  0fafd7            imul edx, edi
0002CC88  0fbeca            movsx ecx, dl
0002CC8B  d1f2              sal edx, 1
0002CC8D  0fafd1            imul edx, ecx
0002CC90  f6d8              neg al
0002CC92  bab983e049        mov edx, 0x49e083b9
0002CC97  69c88060c309      imul ecx, eax, 0x9c36080
0002CC9D  8d15d1abaefa      lea edx, [0xfaaeabd1]
0002CCA3  85ce              test esi, ecx
0002CCA5  eb07              jmp 0x2ccae
0002CCA7  21ca              and edx, ecx
0002CCA9  17                pop ss
0002CCAA  98                cwde
0002CCAB  1db6b3e800        sbb eax, 0xe8b3b6
0002CCB0  0000              add byte ptr [eax], al
0002CCB2  005a85            add byte ptr [edx - 0x7b], bl
0002CCB5  ce                into
0002CCB6  86c1              xchg cl, al
0002CCB8  0fc1d0            xadd eax, edx
0002CCBB  2cc3              sub al, 0xc3
0002CCBD  31fa              xor edx, edi
0002CCBF  8ac2              mov al, dl
0002CCC1  0fafd7            imul edx, edi
0002CCC4  f6c6b3            test dh, 0xb3
0002CCC7  e800000000        call 0x2cccc
0002CCCC  5a                pop edx
0002CCCD  c3                ret
0002CCCE  0000              add byte ptr [eax], al
0002CCD0  0000              add byte ptr [eax], al

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 513,857 bytes but its declared streams total only 18,208 bytes — 495,649 bytes (96%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0002b96f.exe`	embedded-pe	Office MZ+PE at offset 0x2B96F	335314 bytes
SHA-256: `ba1fa120d89403a9886e3654b24767a835454ed120be68d9ef40897da4b4fa44`
Detection ClamAV: Win.Malware.Razy-9886340-0 Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL, SC_STR_CREATEPROCESS, SC_STR_GETPROCADDRESS Static shellcode analysis recovered API/import strings: CreateProcessA, CreateFileA, CreateRemoteThread, GetProcAddress, LoadLibraryA, VirtualProtect
`embedded_office_off0000560d.ole`	embedded-office	Embedded OLE/CFB Office body inside ole container at offset 0x560D	491828 bytes
SHA-256: `3eab1011693e906ef67ed1ca98e0936b6426fe886e84c5062308a7e4630cdb0c`
Detection ClamAV: Win.Malware.Razy-9886340-0 Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL, SC_STR_CREATEPROCESS, SC_STR_GETPROCADDRESS Static shellcode analysis recovered API/import strings: CreateProcessA, CreateFileA, CreateRemoteThread, GetProcAddress, LoadLibraryA, VirtualProtect

Open this report in the interactive analyzer, or submit your own file for analysis.