Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 07e74667ca74d49b…

MALICIOUS

Office (OOXML)

113.9 KB Created: 2021-07-07 11:44:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-09-29
MD5: b3aadc3a050a90aacb50f5f63f8f42ba SHA-1: bffe2fd092ec60df84bd8659a98acacab0fd8056 SHA-256: 07e74667ca74d49b9ad7b83a55f0cb0e36e8cbc0d00f813ed00ffd78c5e8c9b9
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and exhibits characteristics of remote template injection and external relationship usage. These heuristics indicate the document is designed to fetch and execute content from the URL 'https://silindigam.top/ecm/ibm/3755614780/converter.dot', likely to download and run a secondary payload. The document's structure and the presence of external relationships strongly suggest a spearphishing attachment attack vector.

Heuristics 4

  • ClamAV: Doc.Downloader.Office3steps12210-9915225-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Office3steps12210-9915225-0
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (https://silindigam.top/ecm/ibm/3755614780/converter.dot) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: https://silindigam.top/ecm/ibm/3755614780/converter.dot
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://silindigam.top/ecm/ibm/3755614780/converter.dot Remote template reference
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.