Trusted Design

Ongoing analysis of unknown exploit targeting Office 2007-2013

概要

A few days before the publishing of this blog post I came across an unknown RTF exploit sample which I could not identify as being an exploit targeting a known vulnerability like CVE-2012-0158 or CVE-2014-1761. It turns out that this exploit sample has a far greater impact than most other ‘traditional’ memory corruption exploits targeting MS Office. Successful exploitation seems to be possible on all currently supported versions of MS Office up and including the MS15-022 patch.

Created: 2026-02-23

Indicators

• CVE - CVE-2015-1641 -
• hostname - login.loginto.me -
• FileHash-MD5 - 23cc315702179b8552b702892e433801 -
• FileHash-MD5 - ae6b65ca7cbd4ca0ba86c6278c834547 -
• FileHash-MD5 - 6bde5462f45a230edc7e7641dd711505 -

類似Pulses

• CVE-2015-0097 Exploited in the Wild (score: 0.76)
• Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team (score: 0.70)
• Microsoft Office OLE2Link vulnerability samples - a quick triage (score: 0.69)
• MS Office exploit analysis – CVE-2015-1641 (score: 0.66)
• Killing a Zero-Day in the Egg: Adobe CVE-2016-1019 (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る