MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a Microsoft Word document that exploits the CVE-2006-2492 vulnerability. This vulnerability allows for arbitrary code execution when the document is opened. No further details on the payload or family could be determined from the available evidence.
Heuristics 1
-
CVE-2006-2492 — Microsoft Word malformed object pointer exploit critical CVE likely CVE_2006_2492Word OLE document has the CVE-2006-2492-era exploit shape: malformed compound-file object pointers and an impossible WordDocument stream size drive parser divergence, while unreferenced sectors contain rotate-decoded Win32 shellcode that removes Word Resiliency/StartupItems registry keys.
Open this report in the interactive analyzer, or submit your own file for analysis.