Office (OOXML) malware analysis — malicious · 11ad1de30d79ca77

MALICIOUS

Office (OOXML)

11.2 KB First seen: 2015-09-30

MD5: 979d46cdb0ad40b47954e36b37ea0580 SHA-1: 01f1b6c2d623a928c133b661d44668f8741bb378 SHA-256: 11ad1de30d79ca774985391ca8e7bd493800051e69f37986e56aa89397faf856

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The OOXML document presents itself as an invoice for a project meeting, with a request for payment to a specific bank account. The presence of heuristics related to ShellExecute, VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress suggests that the document likely contains malicious code designed to execute a payload, possibly to facilitate further malicious activity beyond the initial social engineering lure.

Heuristics 6

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.