Categories: Malware

OLE:CVE-2017-11882 [Expl] removal

The OLE:CVE-2017-11882 [Expl] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What OLE:CVE-2017-11882 [Expl] virus can do?

Injection (inter-process)
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
A potential decoy document was displayed to the user
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine OLE:CVE-2017-11882 [Expl]?


File Info:
crc32: E58E5017md5: 957d510732ed1c0edd6be4ff09824472name: upload_filesha1: 3f369589500e2c3c4a26efa66d1e169a9779b9c1sha256: 0dcb9f71135a54b97887993f7f33bdf6a32ddb8e0965d22987a863c483cbf3efsha512: d929a3da39543957ef6d2b785315aa8a07593a83953cad9bc5105a97dc2a24c0e982c575519cda016af59317a027de04017337e698d2574d9403b7c5c3561feassdeep: 24576:4UNvkSQUSAPDGm4LuzISDzSezdg0+FebtoP+EwNcoLdtq7x1uTA3dCz:4UqNqGm4LwIUzSezdg0toPGNbLdtq73itype: Composite Document File V2 Document, No summary info
Version Info:
0: [No Data]

OLE:CVE-2017-11882 [Expl] also known as:

MicroWorld-eScan	Exploit.CVE-2017-11882.Gen
FireEye	Exploit.CVE-2017-11882.Gen
McAfee	Exploit-GBR!000000000000
Symantec	Trojan.Gen.MBT
Avast	OLE:CVE-2017-11882 [Expl]
Kaspersky	HEUR:Exploit.MSOffice.Generic
BitDefender	Exploit.CVE-2017-11882.Gen
Ad-Aware	Exploit.CVE-2017-11882.Gen
DrWeb	Exploit.Siggen2.56909
Invincea	Troj/DocExp-AB
McAfee-GW-Edition	Artemis!Trojan
Sophos	Troj/DocExp-AB
Ikarus	Win32.SuspectCrc
MAX	malware (ai score=81)
Arcabit	Exploit.CVE-2017-11882.Gen
ZoneAlarm	HEUR:Exploit.MSOffice.Generic
GData	Exploit.CVE-2017-11882.Gen
ALYac	Exploit.CVE-2017-11882.Gen
TACHYON	Suspicious/W97.CVE-2017-11882
ESET-NOD32	probably a variant of Win32/Exploit.CVE-2017-11882.C
Fortinet	MSOffice/CVE_2017_11882.C!exploit
AVG	OLE:CVE-2017-11882 [Expl]