Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2dec4f9353af7d57…

MALICIOUS

Office (OOXML)

8.9 KB Created: 2020-10-18 13:03:38 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-10-25
MD5: b09d7d2b05377e782b4ad6d23ea646ab SHA-1: 8e399fa7f098b2eb1f76f97c71d3955d3281f010 SHA-256: 2dec4f9353af7d5727840087c617514fbe1409a13811f298ddf2bc1e903813aa
122 Risk Score

Heuristics 3

  • ClamAV: Xml.Exploit.DDE_Abuse-9987933-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xml.Exploit.DDE_Abuse-9987933-1
  • Spreadsheet DDE link launches a dangerous command critical OOXML_SPREADSHEET_DDE_MALICIOUS
    Excel workbook contains an externalLinks/ddeLink entry whose ddeService/ddeTopic launches a dangerous executable. This is SpreadsheetML DDE command execution, distinct from WordprocessingML DDE field instructions.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.168.41.11:9000/plik.exe In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.