Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 3d63156060c7568b…

MALICIOUS

Office (OOXML) / .DOC

3.65 MB Created: 2018-05-02 10:34:00 UTC Authoring application: Microsoft Office Word 15.0000
MD5: 3a5ea4602985f1db670f166e111aefd2 SHA-1: 165975dd8d3965068f3dc0a2c5b512e5e6a9de1f SHA-256: 3d63156060c7568b2c3065820f698fdadb6e48910ec82593a61c306c13f5692c
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059.003 Windows Command Shell

The sample contains a critical heuristic firing for a malicious DDE command, specifically `DDEAUTO c:\windows\system32\cmd.exe “/k notepad.exe”` and `DDEAUTO c:\windows\system32\cmd.exe “/k calc .exe”`. This indicates the document is designed to execute arbitrary commands via DDE auto-execution. The presence of `cmd.exe` and the DDEAUTO command strongly suggests an attempt to run executables or scripts, likely for malicious purposes such as downloading further payloads or establishing persistence.

Heuristics 4

  • Malicious DDE command critical OOXML_DDE_MALICIOUS
    DDE field in word/document.xml launches a dangerous executable: \\system32\\cmd.exe
  • ClamAV: Doc.Exploit.DDEautoexec-6346603-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.DDEautoexec-6346603-1
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://schemas.openxmlformats.org/drawingml/2006/w

Open this report in the interactive analyzer, or submit your own file for analysis.