Doc.Downloader.BLINDINGCAN0 — Office (OOXML) malware analysis

Static analysis result for SHA-256 008e3ac1e6e08a92…

MALICIOUS

Office (OOXML)

122.4 KB Created: 2020-05-07 06:45:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-09-16
MD5: f2784a896d253dc926292ce3766cdd79 SHA-1: 79c95adf60b91b1af927a80a7c177e9f42dbe721 SHA-256: 008e3ac1e6e08a92ff0f51d51ceee74053d8c0fd75266df91bfef586a6d6cd1d
122 Risk Score

Malware Insights

Doc.Downloader.BLINDINGCAN0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Downloader.BLINDINGCAN0. Heuristics indicate the use of remote template injection and external relationships, pointing to an attempt to download and execute a secondary payload from the URL provided. The embedded URL is likely part of the exploit chain.

Heuristics 4

  • ClamAV: Doc.Downloader.BLINDINGCAN0-9448424-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.BLINDINGCAN0-9448424-0
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (https://www.anca-aste.it/uploads/form/boeing_jd_t034519.jpg) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: https://www.anca-aste.it/uploads/form/boeing_jd_t034519.jpg
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.anca-aste.it/uploads/form/boeing_jd_t034519.jpg Remote template reference
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.