Office (OOXML) / .DOC malware analysis — malicious · 4441a4b40a98b0c8

MALICIOUS

Office (OOXML) / .DOC

245.7 KB Created: 2022-07-04 01:58:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-07-05

MD5: ed7ed6a2cbde4d75233729f8d0966c08 SHA-1: ed4bcf60ad3c17a7e64a6d436ad6bff562f13fe8 SHA-256: 4441a4b40a98b0c80405166d87aedc54b20c02ea907848e583396bb3b592d3f2

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1137.001 Office Application Build T1059.005 Visual Basic

The file is a Microsoft Office document containing an embedded OLE object, which in turn contains a VBA macro project. This indicates a likely attempt to deliver a malicious payload through the embedded macro. No specific IOCs were extracted, and the document body was truncated, limiting further analysis of the intended lure.

Heuristics 3

Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/drawing/2016/ink
- http://schemas.microsoft.com/office/drawing/2017/model3d
- http://schemas.microsoft.com/office/2019/extlst
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2018/wordml/cex
- http://schemas.microsoft.com/office/word/2016/wordml/cid
- http://schemas.microsoft.com/office/word/2018/wordml
- http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahash
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 20

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `3e73997df68a0ab4071871481348142d1b106d9e5f177fbe441cf30cf3d734fa`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet3.xls	39424 bytes
`ooxml_oleobject_01.bin` `6edbc0e7fec176dddd21d2a50d65c88eec787679846728570fcb00bb0f0ec943`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet8.xls	39424 bytes
`ooxml_oleobject_02.bin` `e1bfd728b0b8da9da96c2424b193061b617a34059e6a3fe4f27f1e5c723ffd15`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet13.xls	39424 bytes
`ooxml_oleobject_03.bin` `0c41a4d25f4417d7d76010a6d6faf1f5a8f000d1bab9d68e8bec3f958a94ad19`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet16.xls	39424 bytes
`ooxml_oleobject_04.bin` `9cbcebc412e64d264bb52a9eee27405c725936d4ad0ddacfb771374c758e5efa`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet2.xls	39424 bytes
`ooxml_oleobject_05.bin` `ec8fa08122aba42545239a25b5afd6d99612deef80b4113de5f57881a0118c34`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet7.xls	39424 bytes
`ooxml_oleobject_06.bin` `1a4654ebd733f392c620290abded283ccaece1495c6e9ff737a130d9caca900f`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet12.xls	39424 bytes
`ooxml_oleobject_07.bin` `dae56d2322a59d1a9925e7e698265161c959a1617bdbc47da7f28b97f4b23eb3`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet11.xls	39424 bytes
`ooxml_oleobject_08.bin` `bbf79839554b032ce7851539586391a0723bf70e394485c610ab874f91c06490`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet15.xls	39424 bytes
`ooxml_oleobject_09.bin` `215bc3bccd50946f05329a46f31f599514d89694e123f812dd89c674419b70a1`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet1.xls	39424 bytes
`ooxml_oleobject_10.bin` `3914559b0893c5886d1ad2e5eed4900c66ed90dc68e3da72ae6c1a7f2194c070`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet6.xls	39424 bytes
`ooxml_oleobject_11.bin` `24286528cd3225df1013e18170c36f6063fb3a473c887d1e5cea527a44cf578a`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet19.xls	39424 bytes
`ooxml_oleobject_12.bin` `50072708eed598d2fd35736f15cbd0635a66b7cd85e499fc525163db0eb6ad21`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet.xls	39424 bytes
`ooxml_oleobject_13.bin` `b3385d87bf9e5a8c828ccea00bd01451a1df499d2eb074189b5d532eab5bf444`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet10.xls	39424 bytes
`ooxml_oleobject_14.bin` `993a6b858664491af241b6bb76d4360bb6c04f1f61f8669bc15c2338ad2cfafa`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet18.xls	39424 bytes
`ooxml_oleobject_15.bin` `44a958288ee1b956510a2d1c0b8a80e13171cdd07181be91fb2edb859dfd22bc`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet5.xls	39424 bytes
`ooxml_oleobject_16.bin` `b9052ad0c1b11ba563495b1303c6abcfe46b7ee512cffc583748fa249d4b0c23`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet14.xls	39424 bytes
`ooxml_oleobject_17.bin` `699c55bc041571baf67b2ce59d4be288a296221bad4a1bdd5c0b66c8ae6518c0`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet4.xls	39424 bytes
`ooxml_oleobject_18.bin` `3c8f40e8e17c9faaa060cc2c7355cca956f77fb536bf6bb2104bed090b784858`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet9.xls	39424 bytes
`ooxml_oleobject_19.bin` `0760cb6c3b0e7066dd44962187f4071320928e0db893cf4080c1ad1a3e3471e7`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Excel_97-2003_Worksheet17.xls	39424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.