Office (OOXML) / .DOC malware analysis — malicious · 077251a6bcf08baf

MALICIOUS

Office (OOXML) / .DOC

190.6 KB Created: 2025-02-28 09:08:00 UTC Authoring application: Microsoft Office Word 12.0000

MD5: 99e8821ed6403a0bfa9f38e708ae9500 SHA-1: fd682b548c972a7ae6ad63eb5ca8f66ac78873d8 SHA-256: 077251a6bcf08baf538ce935c8a4778efc2cb6eec38dd97376e3ad0175d79f6d

84 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample exhibits characteristics of a malicious OOXML document, specifically remote template injection and external relationship firings, both pointing to the URL https://kutt.ar-email.com.br/sE9xuy?&slippers. This suggests the document is designed to lure the user into downloading and executing a secondary payload. The presence of embedded OLE objects further supports the likelihood of malicious content being delivered.

Heuristics 5

Remote template injection high OOXML_REMOTE_TEMPLATE

Document references a remote template URL (https://kutt.ar-email.com.br/sE9xuy?&slippers) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
External relationship medium OOXML_EXTERNAL_REL

External target in word/_rels/settings.xml.rels: https://kutt.ar-email.com.br/sE9xuy?&slippers
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kutt.ar-email.com.br/sE9xuy?&slippers
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2006/wordml

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `7e0257a6ffe18ab5511a24ce730f5a0ebec5e83e1ca73edec6c64fba5c8264db`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject2.bin	80896 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.70, consistent with packed or encrypted content.
`ooxml_oleobject_00_ole10native_00.bin` `1234d3b1556c1f422697ae19f41e629cba03155b640ac1e345dfaca42ba86cdc`	ole-package	OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	77407 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.82, consistent with packed or encrypted content.
`ooxml_oleobject_01.bin` `d42ef2ba0931ce9f0ecb45b45c4c3676b66de9cc3184d5f34eff0d0c36e3778c`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	111104 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.83, consistent with packed or encrypted content.
`ooxml_oleobject_01_ole10native_00.bin` `b8760f16939dc770033a41ab36a603b82e6e6b0319b2ff530494c7ef0623a1c9`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	107838 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.90, consistent with packed or encrypted content.
`ooxml_oleobject_02.bin` `bae8165eaa8d3cab5fe9dfa98401584944edef8274e68e708dc8b15694e38eee`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject3.bin	95744 bytes
`ooxml_oleobject_02_ole10native_00.bin` `9f5a36429426fde1a6f430cba1f013ae43019c8850a5f77694677e2563e5f673`	ole-package	OOXML word/embeddings/oleObject3.bin Ole10Native stream: Ole10Native	92326 bytes
`emf_00.emf` `2ea53af68bd2029c4227aa285b6770c8dd135be2f35b85d8c9d4ac7c15025877`	ooxml-emf	OOXML EMF part: word/media/image3.emf	7508 bytes
`emf_01.emf` `5ce12f545f1f10ffb3b084a24c50bf7cabc5758dc0e9073aece455eaded41652`	ooxml-emf	OOXML EMF part: word/media/image1.emf	7404 bytes
`emf_02.emf` `22168be6d9b689222b1ffd7e55008911cff6debe16b35f5a37620e9ace7d12bd`	ooxml-emf	OOXML EMF part: word/media/image2.emf	7684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.