Technical intelligence and weaponization dossier for CVE-2015-1641. Documented exploitation across 17 active malware families totaling 7,471 analyzed telemetry samples.
| Vulnerability ID | CVE-2015-1641 |
|---|---|
| Common Name / Bulletin | Microsoft Office Discretionary Memory Corruption Vulnerability (MS15-033) (MS15-033) |
| CWE Classification | CWE-119: Type Confusion / Memory Corruption in word/document.xml |
| Affected Software & Versions | Microsoft Word 2007, 2010, 2013, Office for Mac 2011 |
| Technical Root Cause | Type confusion in Microsoft Word when parsing smart tags and custom XML elements in DOCX documents, exploited widely by Gozi/ISFB and financial trojans. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 17 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| urelas | Infostealer | 666 | Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credentials, session cookies, and... |
| downloadhelper | Adware | 645 | DownloadHelper (cataloged across commercial antivirus telemetry as Adware:Win32/DownloadHelper, PUA.DownloadHelper, and Adware.Toolbar.DownloadHelper) is an int... |
| appster | Adware | 637 | Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetizati... |
| khalesi | Infostealer | 555 | Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system con... |
| softcnapp | Adware | 520 | Softcnapp (tracked across endpoint security engines as PUA:Win32/Softcnapp, Adware:Win32/Softcnapp, and PUP.Optional.Softcnapp) is a rogue application manager, ... |
| wizzmonetize | Adware | 515 | WizzMonetize (also tracked across threat intelligence feeds as Adware:Win32/WizzMonetize, PUA:Win32/WizzMonetize, and Adware.MonetizeInstaller) is an aggressive... |
| kuaizip | Adware | 483 | KuaiZip (cataloged across antimalware engines as PUA:Win32/KuaiZip, Adware:Win32/KuaiZip, and PUP.Optional.KuaiZip, also known as KuaiYa) is a rogue compression... |
| memery | Trojan | 445 | Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and ... |
| skeeyah | Trojan | 440 | Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender tele... |
| winactivator | Pua Tool | 409 | WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of... |
| loadmoney | Adware | 398 | LoadMoney (cataloged across cybersecurity vendors as Adware:Win32/LoadMoney, PUA:Win32/LoadMoney, and PUP.Optional.LoadMoney) is a Russian-origin pay-per-instal... |
| wdfload | Advanced Threat | 358 | Wdfload (cataloged across security software as Trojan:Win32/Wdfload, Rootkit:Win32/Wdfload, and Trojan.Wdfload) is an advanced Windows rootkit and kernel-mode s... |
| ganelp | Trojan | 348 | Ganelp (cataloged across security solutions as Trojan:Win32/Ganelp, Trojan-Spy.Win32.Ganelp, and PWS:Win32/Ganelp) is a specialized password-stealing trojan and... |
| driverpack | Pua | 326 | DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSoluti... |
| nanobot | Rat | 306 | Backdoor:Win32/Nanobot is a modular, lightweight Remote Access Trojan (RAT) and stage-two loader engineered with an extremely compact on-disk footprint (typical... |
| dfay | Trojan | 300 | TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engine... |
| goznym | Banking Trojan | 120 | Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s... |
Threat intelligence confirms the following adversaries weaponize CVE-2015-1641 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2015-1641 in enterprise networks:
DOCX files containing malformed word/document.xml with mismatched smartTagType definitions and deeply nested customXml elements.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →