Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f637d0d79db82882…

MALICIOUS

Office (OLE)

90.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint First seen: 2015-10-02
MD5: c4e411dde517c03f99495af17438bb30 SHA-1: 57441c61077585e8ba3f5bb64fa5a0c9d0ec2c92 SHA-256: f637d0d79db82882079cd9ba72f150c6decf94992c1fbdec89fed993b369befc
300 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is a malicious PowerPoint document that exploits CVE-2011-1269 (MS11-036) to execute a dropped PE file. The document body discusses financial markets and entrepreneurship, likely a lure to disguise the malicious intent. The embedded executable is the primary payload, and its execution is facilitated by the PowerPoint vulnerability.

Heuristics 6

  • PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family critical CVE likely PPT_BINARY_MEMORY_CORRUPTION_PAYLOAD
    A macro-free binary PowerPoint (.ppt) document carries a native code payload (embedded PE and/or process-injection shellcode), staged in an oversized binary stream. Legitimate presentations do not embed executables or shellcode; this is the payload half of a PowerPoint memory-corruption exploit (CVE-2011-1269 / MS11-036 family; the same record-overflow delivery is shared with CVE-2010-2572 and CVE-2009-0556).
  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is related Office object-delivery evidence when paired with exploit payload anomalies, but the malformed graphics record required for exact CVE attribution is not proven by this rule alone.
  • XOR-encoded strings (key 0x52) critical SC_XOR_ENCODED
    Found 2 Windows library/API name(s) XOR-encoded with single-byte key 0x52: 'advapi32.dll', 'ADVAPI32.DLL'
    Disassembly hidden — these bytes score as data, not coherent x86 code (1/2 branch targets land on an instruction boundary (50% coherence)).
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'mov' is 56% of instructions — a sled or padding/filler run, not program logic).
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 92,672 bytes but its declared streams total only 22,602 bytes — 70,070 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_0000bc00.exe embedded-pe Office MZ+PE at offset 0xBC00 44544 bytes
SHA-256: 328587f1856909240b277c2d3eefd20870728e67e75e897047e902d78ab2718c

Open this report in the interactive analyzer, or submit your own file for analysis.