Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 5e3f095b68d0d0e1…

MALICIOUS

Office (OLE) / .PPT

616.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint
MD5: d03569f7d96d4b2a08163171e4f635b0 SHA-1: 7e8dcf65292c3833a8eff4fe755a188865c6c281 SHA-256: 5e3f095b68d0d0e1b09c87cd66fb3c74f2f040be5161293a4c77d2f98eea0a54
382 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.001 PowerShell

The sample is identified as malicious due to critical heuristic firings indicating exploitation of CVE-2006-3590 in PowerPoint, involving malformed shape-container payloads and shellcode. It also references LoadLibrary and GetProcAddress APIs, suggesting dynamic loading of malicious functions. The XOR-encoded strings and PEB access further indicate obfuscation and anti-analysis techniques common in malware.

Heuristics 9

  • CVE-2006-3590 — PowerPoint malformed shape-container payload critical CVE likely CVE_2006_3590
    PowerPoint Pictures stream begins with malformed shape-container material and carries embedded resolver shellcode or a PE-like payload. This matches the MS06-048 mso.dll PowerPoint exploit family tracked as CVE-2006-3590.
  • XOR-encoded strings (key 0x21) critical SC_XOR_ENCODED
    Found 4 Windows library/API name(s) XOR-encoded with single-byte key 0x21: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'InternetOpenA'
  • ClamAV: Win.Trojan.Exploit-110 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Exploit-110
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.iec.ch