MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The sample is an OOXML document containing an embedded OLE object. This object is identified as a package that drops an auto-executable payload, specifically an SCR file named Mystify.scr. This indicates the document is likely intended to trick the user into executing a malicious file, commonly delivered via spearphishing.
Heuristics 3
-
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILEOLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
-
Embedded OLE object medium OOXML_OLE_OBJECTDocument contains an embedded OLE object
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/SMI/2005/WindowsSettings In document text (OOXML body / shared strings)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ooxml_oleobject_00.bin |
ooxml-ole-object | OOXML embedded OLE part: xl/embeddings/oleObject1.bin | 225792 bytes |
SHA-256: d311c1942630b2baba5688a5b562d5b162b29c096966fb0681a1ecb6c285927b |
|||
ooxml_oleobject_00_ole10native_00.bin |
ole-package | OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native | 221559 bytes |
SHA-256: 4726199b8724b0c348175ddbde98860c77b32d4b1a801302a3642291b9645404 |
|||
emf_00.emf |
ooxml-emf | OOXML EMF part: xl/media/image1.emf | 5000 bytes |
SHA-256: 836a273dcb32b678ad8d0c60a0ac11698843a8f797795e00daa67ad04f0d39d6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.