Malicious Office (OLE) / .DOC — malware analysis report

Heuristics 5

• CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456
  WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
• ClamAV: Win.Trojan.Agent-30227 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Agent-30227
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 292,864 bytes but its declared streams total only 94,801 bytes — 198,063 bytes (68%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://ns.adobe.com/xap/1.0/ In document body

  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
  • http://ns.adobe.com/iX/1.0/In document body
  • http://ns.adobe.com/xap/1.0/mm/In document body
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document body

Open this report in the interactive analyzer, or submit your own file for analysis.