Office (OLE) malware analysis — malicious · e3646cbcc528d7c0

MALICIOUS

Office (OLE)

424.5 KB Created: 2012-09-16 06:14:00 Authoring application: Microsoft Office Word First seen: 2015-09-30

MD5: 96443c3ce72f5fca7a1821b03f89de3d SHA-1: 4523183cddb483b22e4cf43891f3b06aa84547d5 SHA-256: e3646cbcc528d7c0bb784ab4cbbf1a6fe18725d2dc110b3efe8f68f6c52ba810

242 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document exploiting CVE-2007-3899 to drop an embedded PE executable. The document body instructs the user to double-click an embedded package named 'TT_Copy', which is identified as a '.scr' file, likely a screensaver or executable. This executable is the primary payload, and the exploit itself is the initial attack vector.

Heuristics 6

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_0000386f.exe`	embedded-pe	Office MZ+PE at offset 0x386F	420241 bytes
SHA-256: `caa4e8cbaa274567893a18c4d84969a0a673c78d275725ec8e788026efebf523`
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_1417271202/Ole10Native	412551 bytes
SHA-256: `6b09a98d33e35804cfccf0b3e23e893932a17608d230c469f917a79f05b80259`

Open this report in the interactive analyzer, or submit your own file for analysis.