MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a malicious OLE document containing an embedded Equation Editor object, a known vector for exploiting Equation Editor vulnerabilities. The presence of a GetPC stub further suggests code execution capabilities. While no specific script was extracted, the combination of these indicators points to an exploit attempting to achieve arbitrary code execution, likely leading to a secondary payload download.
Heuristics 2
-
Equation Editor OLE object high OLE_EQUATION_EDITORContains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ole10native_00.bin9187dc1f085e38cce23433dd68b585db9883def4d639750f040ac2be28b5d3a9 |
ole-package | OLE Ole10Native stream: oLE10NatIve | 920256 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.