Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 0aa9c2d22a3b61ae…

MALICIOUS

Office (OOXML) / .DOC

25.5 KB Created: 2021-09-20 08:40:00 UTC Authoring application: Microsoft Office Word 12.0000
MD5: 2c1fc65ebcf09c1fa1c417aa185e4c29 SHA-1: 84bb8d85b3f4b71e488b05808f03c970db637b4f SHA-256: 0aa9c2d22a3b61aee067d381f9e90efa026d5bfce7747f816c72d26decb58809
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document exhibits characteristics of an advance-fee scam, specifically a lottery fraud, as indicated by the 'SE_ADVANCE_FEE_SCAM_LURE' heuristic and the document body content. It impersonates the Ontario Lottery and Gaming Corporation and instructs the recipient to contact a South African agent via email or phone to claim a fictitious prize. The presence of a remote image beacon suggests an attempt to track document opens.

Heuristics 5

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Remote image (web beacon / tracking pixel) medium OOXML_IMAGE_BEACON
    Document references an external image URL — loads automatically on open, revealing IP address and timestamp to the server (used for phishing tracking and NTLM hash theft on corporate networks)
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: http://www.korkoladesign.com/wp-content/uploads/2015/11/olg.png
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://www.google.co.za/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj1lpbh-d3MAhXqDsAKHd0aCOgQjRwIBw&url=http://www.korkoladesign.com/
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.korkoladesign.com/wp-content/uploads/2015/11/olg.png
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml
    • https://www.google.co.za/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj1lpbh-d3MAhXqDsAKHd0aCOgQjRwIBw&url=http://www.korkoladesign.com/
    • https://www.google.co.za/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj1lpbh-d3MAhXqDsAKHd0aCOgQjRwIBw&url=http://www.korkoladesign.com/portfolio_page/ontario-lottery-and-gamin

Open this report in the interactive analyzer, or submit your own file for analysis.