Malicious Office (OLE) — malware analysis report

Heuristics 7

• MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856 high CVE likely CVE_2012_1856
  MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856
• ClamAV: Win.Trojan.TerminatorRat-2 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.TerminatorRat-2
• NOP sled detected high SC_NOP_SLED
  Found 20+ consecutive 0x90 bytes
  Disassembly hidden — these bytes score as data, not coherent x86 code (1/1 branch targets land on an instruction boundary (100% coherence)).
• x86 GetPC stub (CALL $+5; POP EBX) high SC_GETPC_CALL
  x86 GetPC stub (CALL $+5; POP EBX)
  Disassembly hidden — these bytes score as data, not coherent x86 code (2/3 branch targets land on an instruction boundary (67% coherence)).
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 117,383 bytes but its declared streams total only 20,824 bytes — 96,559 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.