Office (OLE) malware analysis — malicious · cb70b0875f31977b

MALICIOUS

Office (OLE)

129.5 KB Created: 2005-11-11 01:31:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14

MD5: 035fb76fc2ac74ee64691e2ec53447cf SHA-1: c065c2aad6e06f5ebb7ab2690d7eb601bbd0ff82 SHA-256: cb70b0875f31977b0463c2c879f68cee43c5e9f73dd7afd20d6bd25bdf168696

580 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter

The sample is a Microsoft Word document (OLE) that contains an embedded PE executable. Heuristics indicate exploitation of CVE-2008-2244, a vulnerability in Microsoft Word's record-parsing payload, which is used to drop and execute the embedded PE file. The embedded executable was detected by ClamAV as Win.Trojan.Small-1855, suggesting it is a malicious payload. The document body is heavily corrupted and unreadable, providing no further context on the lure.

Heuristics 11

CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244

Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
ClamAV: Win.Trojan.Small-1855 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Small-1855
Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY

Reference to WriteProcessMemory API
Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD

Reference to CreateRemoteThread API
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 132,608 bytes but its declared streams total only 16,416 bytes — 116,192 bytes (88%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00006000.exe`	embedded-pe	Office MZ+PE at offset 0x6000	108032 bytes
SHA-256: `ac5ca2eafb243007903dc9fbd69abb4d515573579d4cb7475c8e571fb9bc2878`
Detection ClamAV: Win.Trojan.Small-1855 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.