MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The critical heuristic firing for CVE-2017-11882 indicates the file is designed to exploit a known vulnerability in the Equation Editor component of Microsoft Office. This vulnerability allows for arbitrary code execution, likely to download and run a secondary payload. The document body is heavily obfuscated and does not provide clear user-facing content, further suggesting a malicious intent behind the exploit.
Heuristics 2
-
CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
-
Equation Editor OLE object high OLE_EQUATION_EDITORContains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
Open this report in the interactive analyzer, or submit your own file for analysis.