Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 7d6ded7db69ce107…

MALICIOUS

Office (OLE) / .DOC

1.06 MB First seen: 2022-08-18
MD5: c60ee75219b97f250b262ae9ec95fc2b SHA-1: 6baf14f75cf99bf4b779c9c04f2c58132e5cb023 SHA-256: 7d6ded7db69ce107be319b49c2be05557f7709574764d359d3f1cb2d9f305287
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1559.001 Component Object Model

The critical heuristic firing for CVE-2017_11882_EQUATION_OLE10NATIVE strongly indicates exploitation of this known vulnerability. The presence of an Equation Editor OLE object further supports this, suggesting the document is designed to trigger this exploit. The embedded OLE object likely contains the secondary payload.

Heuristics 2

  • Equation Editor Ole10Native payload — CVE-2017-11882 critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE
    An embedded Microsoft Equation 3.0 object (CLSID 0002CE02-0000-0000-C000-000000000046) carries an Ole10Native packager stream instead of the normal Equation Native/MTEF data. This is the weaponized Equation Editor RCE delivery shape used by CVE-2017-11882 / CVE-2018-0802 maldocs. The payload (font-record overflow + shellcode) is frequently encrypted and the stream name case-scrambled to evade scanners, but an Equation object holding an Ole10Native stream has no benign use.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ole10native_00.bin
f21af581f51c6a2a5eb3bca192a9afa9c67ea5be0045b77ceadac25c8f0270ff		 ole-package OLE Ole10Native stream: OlE10NatIVE 1095322 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.