Office (OLE) / .DOC malware analysis — malicious · e071640ff8f2f817

MALICIOUS

Office (OLE) / .DOC

2.50 MB First seen: 2022-06-22

MD5: 30f69c94336610432e28a252c7b23092 SHA-1: 10387f821abcc090cb126634eb8608ce414d9b80 SHA-256: e071640ff8f2f817607816ec23a49f3c20fb611903c33aca48e485f5bba47482

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is a Microsoft Word document containing an embedded Equation Editor object. Static analysis detected the Equation Editor OLE object and specifically identified a payload associated with CVE-2017-11882. This indicates the document is designed to exploit this known vulnerability for initial execution. No document body text or scripts were available for further analysis, but the presence of the CVE-2017-11882 exploit is sufficient evidence of malicious intent.

Heuristics 3

Equation Editor Ole10Native payload — CVE-2017-11882 critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE

An embedded Microsoft Equation 3.0 object (CLSID 0002CE02-0000-0000-C000-000000000046) carries an Ole10Native packager stream instead of the normal Equation Native/MTEF data. This is the weaponized Equation Editor RCE delivery shape used by CVE-2017-11882 / CVE-2018-0802 maldocs. The payload (font-record overflow + shellcode) is frequently encrypted and the stream name case-scrambled to evade scanners, but an Equation object holding an Ole10Native stream has no benign use.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `16680ec52c43336e24b9e346c695a9935ed5ca638aa59eaf24c038a82284efce`	ole-package	OLE Ole10Native stream: OLe10NativE	2595372 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.