Malicious Office (OOXML) — malware analysis report

Heuristics 9

• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
  Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
  Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://darkwebnews.com/dark-web/fbi-hacked-tor-and-taken-down-a-child-pornography-site/
• Call-to-action shape / download button low OOXML_DOWNLOAD_SHAPE
  Document drawing contains a call-to-action phrase ('Click Here', 'Download Now', etc.) inside a shape or text box — a common visual lure used to trick users into enabling macros or visiting a malicious URL
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://qzbkwswfv5k2oj5d.onion In document text (OOXML body / shared strings)

  • http://rjuvjyygjqm6mlqm.onionIn document text (OOXML body / shared strings)
  • http://6xydbbfysubflwhw.onionIn document text (OOXML body / shared strings)
  • http://acropolhwczbgbkh.onionIn document text (OOXML body / shared strings)
  • http://msydqstlz2kzerdg.onion/Document hyperlink
  • http://5c62aaokkuc4r72c.onionIn document text (OOXML body / shared strings)
  • http://4cofdcjmrctqgrie.onionIn document text (OOXML body / shared strings)
  • http://y5fmhyqdr6r7ddws.onion/Document hyperlink
  • http://andris23zrbn2da5.onionIn document text (OOXML body / shared strings)
  • http://imtrjn3qe2tzh5ae.onion/Document hyperlink
  • http://ocu3errhpxppmwpr.onionIn document text (OOXML body / shared strings)
  • http://ncikv3i4qfzwy2qy.onionIn document text (OOXML body / shared strings)
  • https://anonmail.biz/Document hyperlink
  • http://confessx3gx46lwg.onionIn document text (OOXML body / shared strings)
  • http://confessx3gx46lwg.onion/Document hyperlink
  • http://rhe4faeuhjs4ldc5.onionIn document text (OOXML body / shared strings)
  • http://apkx44pmf7fyd63e.onionIn document text (OOXML body / shared strings)
  • http://tfwdi3izigxllure.onion/Document hyperlink
  • http://arcadian4nxs3pjr.onionIn document text (OOXML body / shared strings)
  • http://w6csjytbrl273che.onion/Document hyperlink
  • http://w6csjytbrl273che.onionIn document text (OOXML body / shared strings)
  • http://7wxgnvsy7fapoas3.onionIn document text (OOXML body / shared strings)
  • http://wi7qkxyrdpu5cmvr.onion/Document hyperlink
  • http://wi7qkxyrdpu5cmvr.onionIn document text (OOXML body / shared strings)
  • http://qb5qrtbcl7r624gw.onionIn document text (OOXML body / shared strings)
  • http://userl7qp24jlajyx.onionIn document text (OOXML body / shared strings)
  • http://74ypjqjwf6oejmax.onion/Document hyperlink
  • http://sonntag6ej43fv2d.onion/enDocument hyperlink
  • http://fb2lib3argrtulnw.onionIn document text (OOXML body / shared strings)
  • http://bitblendervrfkzr.onionIn document text (OOXML body / shared strings)
  • http://blenderi54mbtyhz.onionIn document text (OOXML body / shared strings)
  • http://blenderri3sud4e6.onionIn document text (OOXML body / shared strings)
  • http://foggedli5gj36eoe.onionIn document text (OOXML body / shared strings)
  • http://4zpinp6gdkjfplhk.onionIn document text (OOXML body / shared strings)
  • http://64f7tpht2ttqyhhj.onionIn document text (OOXML body / shared strings)
  • http://bitmixe4b3xi6pgc.onionIn document text (OOXML body / shared strings)
  • http://s5q54hfww56ov2xc.onion/Document hyperlink
  • http://darkhostkdee7jvi.onionIn document text (OOXML body / shared strings)
  • http://ejz7kqoryhqwosbk.onion/Document hyperlink
  • http://mh7mkfvezts5j6yu.onion/Document hyperlink
  • http://ms26ilrtla2rfuzz.onionIn document text (OOXML body / shared strings)
  • http://3wzc3w4li73zbg7m.onionIn document text (OOXML body / shared strings)
  • http://ll6lardicrvrljvq.onion/Document hyperlink
  • http://bptfp7py2wclht26.onionIn document text (OOXML body / shared strings)
  • http://btcjaww2avywtadz.onionIn document text (OOXML body / shared strings)
  • http://btcmixhnpqlpfacx.onionIn document text (OOXML body / shared strings)
  • http://ztjn5gcdsqeqzmw4.onionIn document text (OOXML body / shared strings)
  • http://fzqnrlcvhkgbdwx5.onion/Document hyperlink
  • http://r2d2akbw3jpt4zbf.onion/Document hyperlink
  • http://eqnbwy4b4k4lrlq5.onionIn document text (OOXML body / shared strings)

  +6006 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.