Malicious Office (OLE) — malware analysis report

Heuristics 20

• CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
  Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
• CVE-2008-2244 — Microsoft Word record-parsing payload (in carved embedded Office document) critical CVE likely CVE_2008_2244
  This finding applies to a carved embedded Office document found at a nonzero offset inside the submitted file, not directly to the top-level document. Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
• ClamAV: Win.Malware.Razy-9886340-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Malware.Razy-9886340-0
• Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
  Reference to URLDownloadToFile API
• Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
  Reference to WriteProcessMemory API
• Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
  Reference to CreateRemoteThread API
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
  A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
• x86 GetPC stub (CALL $+5; POP EDX) high SC_GETPC_CALL
  x86 GetPC stub (CALL $+5; POP EDX)
  Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'add' is 72% of instructions — a sled or padding/filler run, not program logic).
• Reference to WinExec API high SC_STR_WINEXEC
  Reference to WinExec API
• Reference to CreateProcess API high SC_STR_CREATEPROCESS
  Reference to CreateProcess API
• Reference to ShellExecute API high SC_STR_SHELLEXEC
  Reference to ShellExecute API
• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
  Reference to GetProcAddress API
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 703,321 bytes but its declared streams total only 18,208 bytes — 685,113 bytes (97%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
  Reference to VirtualAlloc API
• Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
  Reference to VirtualProtect API
• Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://upx.tsx.org In document text (OLE body)

  • http://microsoft.com0In document text (OLE body)
  • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn document text (OLE body)
  • http://www.microsoft.com/pki/certs/CSPCA.crt0In document text (OLE body)
  • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn document text (OLE body)
  • http://www.microsoft.com/pki/certs/tspca.crt0In document text (OLE body)
  • http://go.microsoft.com/fwlink/?LinkId=96782ARPNOMODIFYARPURLUpdateInfohttp://go.microsoft.com/fwlink/?LinkId=96789comspec_cmd%comspec%DDPatchDiskNo1[DiskIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.