Office (OOXML) / .DOC static analysis report

Static analysis result for SHA-256 469648da328b8015…

SUSPICIOUS

Office (OOXML) / .DOC

270.5 KB Created: 2022-05-26 20:30:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2022-05-27
MD5: 05917dd297edfa2ce0537c33c0270a4f SHA-1: 75bb7234e63de8db41b40cd804e83b4fdbd99038 SHA-256: 469648da328b80157ed58a11466051744128cbf0ed2e9463f3f41a25018872d7
50 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The document contains external hyperlinks and an external relationship pointing to a seemingly legitimate J.P. Morgan domain, but also a local file path that could be used to load malicious templates. The document body text is a lure for a conference call, suggesting a phishing or credential harvesting attempt. No scripts were extracted from this sample, limiting the ability to determine further malicious intent.

Heuristics 3

  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: file:///C:\Users\f693375\AppData\Roaming\JPMC\GPS\WebMailTemplate.dotm
  • External hyperlinks (10) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 10 external hyperlinks — clickable URLs are stored as external relationships. First target: http://www.jpmm.com/Research/Multimedia
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.netroadshow.com/events/login?show=60b9654a&confId=36822 Document hyperlink
    • https://jpmm.com/research/disclosuresOOXML external relationship
    • http://www.jpmorganmarkets.comDocument hyperlink
    • https://www.jpmm.com/research/disclosuresDocument hyperlink
    • http://www.jpmm.com/Research/MultimediaDocument hyperlink
    • https://www.jpmm.com/research/content/publication/9000789Document hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship
    • https://www.jpmorgan.com/disclosures/cryptoasset-disclosureDocument hyperlink
    • https://markets.jpmorgan.com/research/disclosuresDocument hyperlink
    • http://www.apple.com/DTDs/PropertyList-1.0.dtdOOXML external relationship
    • http://ns.adobe.com/xap/1.0/OOXML external relationship
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#OOXML external relationship
    • http://purl.org/dc/elements/1.1/OOXML external relationship
    • http://ns.adobe.com/xap/1.0/mm/OOXML external relationship
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#OOXML external relationship
    • http://ns.adobe.com/illustrator/1.0/OOXML external relationship
    • http://ns.adobe.com/xap/1.0/t/pg/OOXML external relationship
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#OOXML external relationship
    • http://ns.adobe.com/xap/1.0/g/OOXML external relationship
    • http://ns.adobe.com/photoshop/1.0/OOXML external relationship
    • http://ns.adobe.com/tiff/1.0/OOXML external relationship
    • http://ns.adobe.com/exif/1.0/OOXML external relationship
    • http://www.iec.chOOXML external relationship
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#OOXML external relationship
    • https://markets.jpmorgan.com/Document hyperlink

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.