MALICIOUS
382
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1059.001 PowerShell
The sample is identified as malicious due to critical heuristic firings indicating exploitation of CVE-2006-3590 in PowerPoint, involving malformed shape-container payloads and shellcode. It also references LoadLibrary and GetProcAddress APIs, suggesting dynamic loading of malicious functions. The XOR-encoded strings and PEB access further indicate obfuscation and anti-analysis techniques common in malware.
Heuristics 9
-
CVE-2006-3590 — PowerPoint malformed shape-container payload critical CVE likely CVE_2006_3590PowerPoint Pictures stream begins with malformed shape-container material and carries embedded resolver shellcode or a PE-like payload. This matches the MS06-048 mso.dll PowerPoint exploit family tracked as CVE-2006-3590.
-
XOR-encoded strings (key 0x21) critical SC_XOR_ENCODEDFound 4 Windows library/API name(s) XOR-encoded with single-byte key 0x21: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'InternetOpenA'
-
ClamAV: Win.Trojan.Exploit-110 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Exploit-110
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
PEB API-hash resolver high SC_API_HASH_RESOLVERPEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.iec.ch
Open this report in the interactive analyzer, or submit your own file for analysis.