Office (OOXML) malware analysis — malicious · 2bfdb32860a99dc2

MALICIOUS

Office (OOXML)

169.2 KB Created: 2021-05-13 16:20:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-23

MD5: af7ee4f20a624c4d7b5cfc7adde79332 SHA-1: 6f486aadfe01c2101dc386a64554908c31afb6d3 SHA-256: 2bfdb32860a99dc2edce59ff9c92da4e64459396097e7e58db6e9aae892550b6

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing multiple embedded OLE objects, one of which was identified as containing a VBA macro project. The heuristic 'EXTRACTION_FILE_STATIC_TRIAGE' specifically flagged suspicious VBA auto-execution with execution terms, indicating the embedded macro is likely designed to run automatically and execute a secondary payload. The presence of these embedded macros strongly suggests a spearphishing attachment attack vector.

Heuristics 4

Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 12

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet3.xls	38912 bytes
SHA-256: `72db11fb03a9815a50ecdef4fad7fd3839267f153257e329094722495e706342`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet8.xls	38912 bytes
SHA-256: `3c5f7266faed6950644aa0612ae69924e439c903170ed664590cb8721c1f1dc2`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet2.xls	38912 bytes
SHA-256: `0e8096cf809b76f8b6205850a0b3bd18b6e612b11bc0ab274b02f5bed331f1ae`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_03.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet7.xls	38912 bytes
SHA-256: `6954c848efb151226cb87325bc718d15c00854e96eb85f72bf33930d7fd6504c`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_04.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet11.xls	38912 bytes
SHA-256: `6b61b72228deb7b6f921311c68d85ed5eaeb5db6c175b79b66c2025aed5ac712`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_05.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet1.xls	38912 bytes
SHA-256: `bdd16f5a3afca3ac1f30fab7218d812555a9c4b0dae3a41cd8648ee520b9fa21`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_06.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet6.xls	38912 bytes
SHA-256: `0a4b0eb90c16aa8dfa5f13f7f8f97d857dfb44cf147f23647246e50b50e9c09c`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_07.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet.xls	38912 bytes
SHA-256: `cc1060e02a823ec9aba9dac89721ca5fe178d099b15470d5318161fd5ae551f7`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_08.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet10.xls	38912 bytes
SHA-256: `d2bf75ea97c11396d3cdf2f3f0a5fcd55d22b528007d310502af0b63a03814b5`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_09.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet5.xls	38912 bytes
SHA-256: `e213f2e2f65002eb0260cbbcebebe82405c960636a20d48f8714813a715bc984`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_10.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet4.xls	38912 bytes
SHA-256: `a7a04dd32925df5799b6808689ef27543cf2958f9a5b71eb264610a9ce41f5d0`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_11.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet9.xls	38912 bytes
SHA-256: `dbbfb8b50451efdb0b5aabcf6c54b9552d7588c5f0d79258b9b86b20f54bac5c`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.