Office (OOXML) malware analysis — malicious · 2ca00756ea7a100d

MALICIOUS

Office (OOXML)

45.6 KB Created: 2017-05-12 06:54:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2017-10-10

MD5: 5489ff217df24c4bfb4e12cf81ec7d4b SHA-1: 73145de00796f96e443e37368a199c51bf8becd7 SHA-256: 2ca00756ea7a100de3038cf01ae197f34cd4d9ec5e5f28bfb6218011fd14af37

202 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file contains an embedded OLE object that is flagged as a dropper for a JavaScript payload. ClamAV detections confirm this, identifying the file as 'Doc.Dropper.Agent-6349058-0' and an extracted artifact as 'Doc.Dropper.Agent-6338561-0'. The document body contains a lure in German, prompting the user to select a preferred format to open an invoice, which is a common social engineering tactic for malicious documents.

Heuristics 4

ClamAV: Doc.Dropper.Agent-6349058-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6349058-0
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	54272 bytes
SHA-256: `e7f9f5941647994cfe094eafde10d6eaaa9fa7a2655e612ad5718e6c12900e93`
Detection ClamAV: Doc.Dropper.Agent-6349058-0 Obfuscation or payload: unlikely
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	50744 bytes
SHA-256: `7eb7dc5e16bdc1e69e4f4652c1fcf479ad10bb44999897a47a399e6f233514f8`
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject2.bin	54272 bytes
SHA-256: `8241f8d6c162ca657ce0cead3583da6404cb643e6224b53cd5b1538616cde79d`
Detection ClamAV: Doc.Dropper.Agent-6338561-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	50744 bytes
SHA-256: `664612ce506c9fb3884daa11fd52046e5c3959b6e79800d5d2bb55e0833185ae`
`emf_00.emf`	ooxml-emf	OOXML EMF part: word/media/image3.emf	7468 bytes
SHA-256: `d7c0979ef8bf29da198dc00381b56bdf0880bbb2380f70a162dcfe6500562273`
`emf_01.emf`	ooxml-emf	OOXML EMF part: word/media/image2.emf	7468 bytes
SHA-256: `f7f01bc09176582fdd082864cc3d7d3c8cf3d8123c7075e2d352266a09f72589`

Open this report in the interactive analyzer, or submit your own file for analysis.