Malicious Office (OLE) — malware analysis report

Heuristics 12

• CVE-2008-2244 — Microsoft Word record-parsing payload critical CVE likely CVE_2008_2244
  Word OLE document has normal small WordDocument/table streams, a large unallocated OLE slack region, and an executable or resolver shellcode payload in that slack. This is the static shape of the MS08-042 Word record-parsing exploit family tracked as CVE-2008-2244.
• PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family critical CVE likely PPT_BINARY_MEMORY_CORRUPTION_PAYLOAD
  A macro-free binary PowerPoint (.ppt) document carries a native code payload (embedded PE and/or process-injection shellcode), staged in an oversized binary stream. Legitimate presentations do not embed executables or shellcode; this is the payload half of a PowerPoint memory-corruption exploit (CVE-2011-1269 / MS11-036 family; the same record-overflow delivery is shared with CVE-2010-2572 and CVE-2009-0556).
• Office EPRINT stream contains EMF object low CVE related OLE_EPRINT_EMF_OBJECT
  OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is related Office object-delivery evidence when paired with exploit payload anomalies, but the malformed graphics record required for exact CVE attribution is not proven by this rule alone.
• ClamAV: Win.Trojan.Agent-887516 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Agent-887516
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• PEB access via FS segment (x86) high SC_PEB_ACCESS
  PEB access via FS segment (x86)
  Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'mov' is 58% of instructions — a sled or padding/filler run, not program logic).
• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
  Reference to GetProcAddress API
• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 128,832 bytes but its declared streams total only 40,506 bytes — 88,326 bytes (69%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
  Reference to VirtualProtect API
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://ocsp.verisign.com0 In document text (OLE body)

  • http://crl.verisign.com/tss-ca.crl0In document text (OLE body)
  • http://crl.verisign.com/ThawteTimestampingCA.crl0In document text (OLE body)
  • https://www.verisign.com/rpaIn document text (OLE body)
  • https://www.verisign.com/rpa01In document text (OLE body)
  • http://crl.verisign.com/pca3.crl0In document text (OLE body)
  • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn document text (OLE body)
  • https://www.verisign.com/rpa0In document text (OLE body)
  • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.