Office (OOXML) / .DOC malware analysis — suspicious · 10b31771e6e9d6db

SUSPICIOUS

Office (OOXML) / .DOC

66.7 KB Created: 2023-02-22 02:37:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2023-02-22

MD5: 1fe08f942343a6102aa9e9fd6acea30b SHA-1: de9cdb02f5074e0553cdd2fc34c0d3cd9645e36a SHA-256: 10b31771e6e9d6db03044f3ac5e1e8ed286e1d6bd76892c5bca93280cbf84ea1

42 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The embedded JavaScript attempts to construct a fake Outlook login page, likely for credential harvesting. The script dynamically loads resources from external URLs, including CSS and JavaScript files, to mimic the legitimate Outlook sign-in interface. The heuristic firing SE_LOLBIN_RUN_COMMAND suggests potential execution of commands, further indicating malicious intent.

Heuristics 2

LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.cssIn document text (OOXML body / shared strings)
- https://code.jquery.com/jquery-3.1.1.min.jsIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-light.eot?#iefixIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-light.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-light.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-regular.eot?#iefixIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-regular.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-regular.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semibold.eot?#iefixIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semibold.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semibold.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semilight.eot?#iefixIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semilight.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/assets/mail/fonts/v1/fonts/segoeui-semilight.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/o365icons-mdl2.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/o365icons-mdl2.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/office365icons.eotIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/office365icons.eot?#iefixIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/office365icons.woffIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/office365icons.ttfIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamail/20220325002.04/resources/fonts/office365icons.svg?#office365iconsIn document text (OOXML body / shared strings)
- https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.icoIn document text (OOXML body / shared strings)
- https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svgIn document text (OOXML body / shared strings)
- https://www.microsoft.com/fr/servicesagreement/In document text (OOXML body / shared strings)
- https://privacy.microsoft.com/fr/privacystatementIn document text (OOXML body / shared strings)
- https://outlook-1.cdn.office.net/owamIn macro / runtime command snippet

Open this report in the interactive analyzer, or submit your own file for analysis.

Office (OOXML) / .DOC

Malware Insights

Heuristics 2

Related samples 6