MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious Link
T1204.002 Malicious Link: Malicious File
The sample is a PowerPoint file that contains a critical heuristic indicating the exploitation of CVE-2006-3877, a vulnerability related to malformed records in PowerPoint files. While VBA macros could not be extracted due to an unsupported format, the presence of this exploit suggests the file is designed to deliver a malicious payload upon opening. The embedded URL heuristic further supports the likelihood of a delivery mechanism.
Heuristics 1
-
CVE-2006-3877 — PowerPoint malformed record payload critical CVE likely CVE_2006_3877PowerPoint OLE file declares a malformed large numbered Table stream that cannot be read through the CFB chain, while the carved stream bytes contain a encoded shellcode payload. This is the static shape of the PowerPoint malformed-record exploit family fixed as CVE-2006-3877.
Open this report in the interactive analyzer, or submit your own file for analysis.