Trusted Design

CVE-2015-0097 Exploited in the Wild

概要

In March 2015, Microsoft patched a remote code execution (RCE) vulnerability (CVE-2015-0097) in Microsoft Office. In July 2015, Eduardo Prado released a Proof of Concept (PoC) exploit for this vulnerability here. It did not take long for attackers to repackage this PoC and use it in attacks in the wild. We observed a few variants of attacks exploiting CVE-2015-0097 that are using the same PoC to create a .doc exploit. This vulnerability could also be exploited using other Office file formats.

Created: 2026-02-23

Indicators

• hostname - vietapps.vietimes.org -
• CVE - CVE-2015-0097 -
• URL - http://219.122.54.178/config.vbs -
• Mutex - Global\\PPDrXvsnAXozQjJvVXZHB -

類似Pulses

• Ongoing analysis of unknown exploit targeting Office 2007-2013 (score: 0.76)
• FIREEYE: Office Encapsulated PostScript & Priv Escalation 0days (score: 0.74)
• Microsoft Office OLE2Link vulnerability samples - a quick triage (score: 0.73)
• Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team (score: 0.72)
• MS Office exploit analysis – CVE-2015-1641 (score: 0.72)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る