Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1c65c495fcf4d2d7…

MALICIOUS

Office (OOXML)

11.4 KB Created: 2018-09-18 11:48:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2019-04-18
MD5: 3f850bdecf20c20bf408926ced73c085 SHA-1: 76b817151c679f391e5ff5d6cebe04052d67f62e SHA-256: 1c65c495fcf4d2d750b609fe824932324f7fd694b86d7642d966f21885eac56e
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV, specifically as a downloader. Heuristics indicate the presence of external relationships and remote template injection pointing to the URL http://al-tasmem.ga/doc/ixer.doc, which targets a free TLD. This suggests the document is designed to lure the user into downloading and executing a secondary payload from this malicious URL.

Heuristics 5

  • ClamAV: Doc.Downloader.Redline-9972754-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Redline-9972754-0
  • OOXML external relationship targets a free/throwaway TLD high OOXML_EXTERNAL_REL_FREE_TLD
    Document has an external relationship whose target host is on a free, no-registration TLD (Freenom .ml/.ga/.cf/.gq/.tk). Legitimate business documents do not link out to a Freenom throwaway domain; these are a near-zero-FP phishing / BEC delivery tell (e.g. an RFQ/invoice lure pointing at 'shareddocuments.ml/RFQ'). The relationship may be a hyperlink, a remote template, or an external OLE object.
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (http://al-tasmem.ga/doc/ixer.doc) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/webSettings.xml.rels: http://al-tasmem.ga/doc/ixer.doc
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://al-tasmem.ga/doc/ixer.doc OOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.