MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: User Execution: Malicious File
T1059.001 Command and Scripting Interpreter: PowerShell
The sample is a malicious Microsoft Word document exploiting CVE-2006-6456, a vulnerability related to malformed tables. Heuristics indicate PEB access and XOR-encoded strings, suggesting an attempt to obfuscate malicious code execution. No VBA macros were extractable, but the exploit itself is sufficient to indicate malicious intent. The document body is heavily corrupted and unreadable, providing no further context.
Heuristics 5
-
CVE-2006-6456 — Microsoft Word malformed table SPRM critical CVE exact CVE_2006_6456WordDocument contains a malformed table border-color SPRM in the CVE-2006-6456 shape: a valid table-SPRM cluster is followed by an invalid high-byte 0xFF SPRM where Word expects a normal sprmTBrc*Cv record. Vulnerable Word 2000/2002/2003 parsers corrupt memory while handling this malformed data structure.
-
XOR-encoded strings (key 0xAB) critical SC_XOR_ENCODEDFound 3 Windows library/API name(s) XOR-encoded with single-byte key 0xAB: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress'
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
PEB API-hash resolver high SC_API_HASH_RESOLVERPEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.