Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 708b19f20506a77f…

MALICIOUS

Office (OLE)

618.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint
MD5: 6c5e222320773ac8123d9766f4649e07 SHA-1: f67e32f7bd374d8eb4a5e5b87af123fc5c883eb6 SHA-256: 708b19f20506a77f05f8d6b717ca88cfd01eb20bca0b54bed560803b57a24b72
480 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is a malicious PowerPoint document that leverages the CVE-2006-0022 vulnerability to execute arbitrary code. Static analysis indicates the presence of APIs like CreateProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, strongly suggesting the exploitation of this vulnerability to load and run a secondary payload. The embedded executable further supports this finding.

Heuristics 11

  • CVE-2006-0022 — PowerPoint malformed picture-record payload critical CVE likely CVE_2006_0022
    PowerPoint OLE file contains a malformed large Pictures stream that cannot be read through the declared CFB chain, while the contiguous stream bytes contain image material and a PE-like payload. This is the static shape of the PowerPoint malformed-record exploit fixed as CVE-2006-0022.
  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EAX)
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Embedded PE executable high OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Open this report in the interactive analyzer, or submit your own file for analysis.