Malicious Office (OLE) / .DOC — malware analysis report

Heuristics 6

• MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856 high CVE likely CVE_2012_1856
  MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856
• ClamAV: Doc.Exploit.Agent-1388627 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Exploit.Agent-1388627
• NOP sled detected high SC_NOP_SLED
  Found 20+ consecutive 0x90 bytes
  Disassembly hidden — these bytes score as data, not coherent x86 code (1/1 branch targets land on an instruction boundary (100% coherence)).
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 3,906,085 bytes but its declared streams total only 20,824 bytes — 3,885,261 bytes (99%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.