Office (OLE) / .DOCX malware analysis — malicious · e61717cf4a038f74

MALICIOUS

Office (OLE) / .DOCX

2.18 MB First seen: 2022-05-09

MD5: c3f125f4e79514cde54d183b21c4d76b SHA-1: e5e94f5d5f20de7f2fa25da414171de2adedb220 SHA-256: e61717cf4a038f744842b962b3b4f0dfb6ad2145245246bb0f78806f6ea2cadb

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The presence of an Equation Editor OLE object and a suspicious extracted artifact strongly suggests exploitation of a vulnerability within the Equation Editor component. The 'x86 GetPC stub' heuristic further indicates code execution capabilities. This points to a malicious document designed to exploit this vulnerability, likely delivered as an attachment.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL

x86 GetPC stub (CALL $+5; POP EAX)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ole10native_00.bin` `0be218f0d671646acfb90c78e76b3129d80d886b85e2def2f57097b27aab2ad3`	ole-package	OLE Ole10Native stream: Ole10natIvE	2263844 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.