Malicious Office (OLE) — malware analysis report

Heuristics 12

• CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
  Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
• CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244
  Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
• ClamAV: Win.Malware.Razy-9886340-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Malware.Razy-9886340-0
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
  A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
  Reference to GetProcAddress API
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 393,533 bytes but its declared streams total only 18,208 bytes — 375,325 bytes (95%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
  Reference to VirtualAlloc API
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://microsoft.com0 In document text (OLE body)

  • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn document text (OLE body)
  • http://www.microsoft.com/pki/certs/CSPCA.crt0In document text (OLE body)
  • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn document text (OLE body)
  • http://www.microsoft.com/pki/certs/tspca.crt0In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.