Categories: Malware

Exploit:O97M/CVE-2017-11882!MTB (file analysis)

The Exploit:O97M/CVE-2017-11882!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Exploit:O97M/CVE-2017-11882!MTB virus can do?

Injection (inter-process)
Uses Windows utilities for basic functionality
A potential decoy document was displayed to the user
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Exploit:O97M/CVE-2017-11882!MTB?


File Info:
crc32: 8184364Cmd5: 5ac1a8447e27ba7a02792462f2ee9da9name: 921c2afd2d16cb6dbc36e9e90990a04fbb0f92b7.binsha1: 921c2afd2d16cb6dbc36e9e90990a04fbb0f92b7sha256: 70d481093e2d549329ff5fe89d82e39dbb09d9385dd381fd7ef4f4a63987f398sha512: dbe2d05e3470ea245b321b124241300d6ef5cccddaf225867f2eb86d7af656be3ec54bc1ba379fdd1aa827652acb04233eb35c01fe281a25f3cf707899f6b48assdeep: 6144:CNWnfg7652ecPHTdlsNCb7t0UFkwqj9lJwlqSG:I0f665D2TfsQb7BFRw9lJLxtype: Composite Document File V2 Document, No summary info
Version Info:
0: [No Data]

Exploit:O97M/CVE-2017-11882!MTB also known as:

MicroWorld-eScan	Exploit.CVE-2017-11882.Gen
FireEye	Exploit.CVE-2017-11882.Gen
CAT-QuickHeal	Exp.OLE.CVE-2017-11882.38895.GC
McAfee	Exploit-GAF!5AC1A8447E27
AegisLab	Hacktool.MSOffice.Generic.3!c
Sangfor	Malware
Cyren	CVE-2017-11882.C.gen!Camelot
Symantec	Exp.CVE-2017-11882!g2
Avast	Win32:ShellCode [Expl]
Kaspersky	HEUR:Exploit.MSOffice.Generic
BitDefender	Exploit.CVE-2017-11882.Gen
ViRobot	DOC.Z.CVE-2017-1188.258048
Rising	Exploit.CVE-2017-11882!1.B31E (CLASSIC)
Ad-Aware	Exploit.CVE-2017-11882.Gen
Sophos	Troj/DocExp-AB
Comodo	TrojWare.Win32.UMal.dacnm@0
F-Secure	Exploit.EXP/CVE-2017-11882.Gen
Invincea	Troj/DocExp-AB
Emsisoft	Exploit.CVE-2017-11882.Gen (B)
Ikarus	Exploit.CVE-2017-11882
Avira	EXP/CVE-2017-11882.Gen
MAX	malware (ai score=100)
Microsoft	Exploit:O97M/CVE-2017-11882!MTB
Arcabit	Exploit.CVE-2017-11882.Gen
ZoneAlarm	HEUR:Exploit.MSOffice.Generic
GData	Exploit.CVE-2017-11882.Gen
Cynet	Malicious (score: 85)
AhnLab-V3	OLE/Cve-2017-11882.Gen
ALYac	Exploit.CVE-2017-11882.Gen
TACHYON	Trojan-Exploit/W97.CVE-2017-11882
Zoner	Probably Heur.W97NativeOnly
ESET-NOD32	probably a variant of Win32/Exploit.CVE-2017-11882.B
Tencent	Office.Exploit.Generic.Szbt
SentinelOne	DFI – Malicious OLE
Fortinet	MSOffice/CVE_2017_11882.C!exploit
AVG	Win32:ShellCode [Expl]
Qihoo-360	Generic/Trojan.Exploit.ed7