Office (OOXML) malware analysis — malicious · 18c75ea7c7ac8a2a

MALICIOUS

Office (OOXML)

56.5 KB Created: 2017-05-12 06:54:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2017-10-10

MD5: 9cb7c914be9f59f860fa4fba54c096af SHA-1: 0e104e41ae00d3a2ba5128efdeebe02053b300f4 SHA-256: 18c75ea7c7ac8a2afb3ea9257af3c3522750db9d19417f470cc546540879d573

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious OOXML document containing embedded OLE objects, one of which is identified as a package that drops an auto-executable JavaScript payload. The document body text suggests a lure related to opening a bill, indicating a likely spearphishing attachment attack vector. The embedded OLE objects and the potential for JavaScript execution are the primary indicators of malicious activity.

Heuristics 3

Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject2.bin	52224 bytes
SHA-256: `31c7b4a763401c2fdb51841fde11d99c084ebb6629b830c4d3184638c8e9fc86`
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	48641 bytes
SHA-256: `b2f48b3bceea63ff7e4620d3afe3813da0b06dcd5e47d18ca4c9cbacc5f7f476`
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject3.bin	52224 bytes
SHA-256: `3b83a8d775ea62ea2053780db62723cc53bd00a0f6b3256fe8c0e508b5487099`
`ooxml_oleobject_01_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject3.bin Ole10Native stream: Ole10Native	48650 bytes
SHA-256: `a262eb50c57f4613a743e57e6b58161767c655aae01043b3c453660c6bcfc550`
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	52224 bytes
SHA-256: `595dc9a99fcc24c5952e631e83388be11a176fef999e466bdf6a9032948f65e7`
`ooxml_oleobject_02_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	48659 bytes
SHA-256: `49aab153d35ef52d27dddb06bc4ef038f36bde4af049ffcaf5b98d1e8f7a13f8`
`emf_00.emf`	ooxml-emf	OOXML EMF part: word/media/image4.emf	7444 bytes
SHA-256: `88df92a0a7f5b0ee4460140180fead708613d43e0d08112be40d5ebf1895ec04`
`emf_01.emf`	ooxml-emf	OOXML EMF part: word/media/image3.emf	7436 bytes
SHA-256: `3e4628079096d5c28d12b56cad563ce6d28026709639e11ac315fb21ee1a0d1f`
`emf_02.emf`	ooxml-emf	OOXML EMF part: word/media/image2.emf	7492 bytes
SHA-256: `e659ae7b52dc5b71c6c02e0c9dd9bafd6235a4e42cde335b7b861db8480c9841`

Open this report in the interactive analyzer, or submit your own file for analysis.