TrickBot — Office (OOXML) malware analysis

Static analysis result for SHA-256 17f73a5cd04ca12f…

MALICIOUS

Office (OOXML)

455.5 KB Created: 2020-02-11 21:15:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: ab284dccb09484ff6a3a116152edcb75 SHA-1: 68bfb664e9712195e83d401b5775c475842cb72d SHA-256: 17f73a5cd04ca12f2a9b359d2871fc6bf198c4952dc715b57970eea0bd78471c
224 Risk Score

Malware Insights

TrickBot · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer

The sample was identified as malicious by ClamAV as Win.Dropper.TrickBot-7586525-0. Heuristics indicate the presence of an embedded OLE object containing an executable payload, strongly suggesting exploitation of CVE-2026-21514. This object likely downloads and executes a second-stage payload from the identified URLs.

Heuristics 6

  • ClamAV: Win.Dropper.TrickBot-7586525-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.TrickBot-7586525-0
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Payload URL recovered from embedded OLE object (20 URLs) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.digicert.com0C In document text (OOXML body / shared strings)
    • http://ocsp.digicert.com0NIn document text (OOXML body / shared strings)
    • http://ocsp.digicert.com0AIn document text (OOXML body / shared strings)
    • http://ocsp.digicert.com0OIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0In document text (OOXML body / shared strings)
    • http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0OIn document text (OOXML body / shared strings)
    • https://www.digicert.com/CPS0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/sha2-assured-cs-g1.crl05In document text (OOXML body / shared strings)
    • http://crl4.digicert.com/sha2-assured-cs-g1.crl0LIn document text (OOXML body / shared strings)
    • http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0In document text (OOXML body / shared strings)
    • http://www.digicert.com/ssl-cps-repository.htm0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08In document text (OOXML body / shared strings)
    • http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0wIn document text (OOXML body / shared strings)
    • http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/sha2-assured-ts.crl02In document text (OOXML body / shared strings)
    • http://crl4.digicert.com/sha2-assured-ts.crl0In document text (OOXML body / shared strings)
    • http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0PIn document text (OOXML body / shared strings)
    • http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0��In document text (OOXML body / shared strings)
    • http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:�8�6�4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0OIn document text (OOXML body / shared strings)
    • http://crl3.digicert.com/sha2-assured-cs-g1.crl05�3�1�/http://crl4.digicert.com/sha2-assured-cs-g1.crl0LIn document text (OOXML body / shared strings)
    • http://www.digicert.com/ssl-cps-repository.htm0�In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:�8�6�4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0In document text (OOXML body / shared strings)
    • https://www.digicert.com/CPS0�In document text (OOXML body / shared strings)
    • http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08�6�4�2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0wIn document text (OOXML body / shared strings)
    • http://crl3.digicert.com/sha2-assured-ts.crl02�0�.�,http://crl4.digicert.com/sha2-assured-ts.crl0��In document text (OOXML body / shared strings)
    +1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 753152 bytes
SHA-256: be03c2f647db2fee1955fb5efd08f4df29cf4082eda489c3b4705b152f687a32
Detection
ClamAV: Win.Dropper.TrickBot-7586525-0
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_GETPROCADDRESS, SC_STR_VIRTUALALLOC Static shellcode analysis recovered API/import strings: LoadLibraryW, GetProcAddress, ExitProcess, VirtualAlloc
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 744165 bytes
SHA-256: 96bb41cf998d3da685f344fb43765f600bf6b7b258e7cebacf63d0c6dbf0fb3b
Detection
ClamAV: Win.Dropper.TrickBot-7586525-0
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_GETPROCADDRESS, SC_STR_VIRTUALALLOC Static shellcode analysis recovered API/import strings: LoadLibraryW, GetProcAddress, ExitProcess, VirtualAlloc
emf_00.emf ooxml-emf OOXML EMF part: word/media/image2.emf 5192 bytes
SHA-256: d3064788146ca645a26ad3229b7df732c92344e138172e27428af96bb44eb2c5

Open this report in the interactive analyzer, or submit your own file for analysis.