Office (OOXML) / .DOC malware analysis — malicious · 506c879bf141692e

MALICIOUS

Office (OOXML) / .DOC

17.6 KB Created: 2022-06-03 18:42:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-08-17

MD5: a5b943472623355d8a81d1ba7a514356 SHA-1: 4235f556ce9401677f50f48755c698db5f4ab2fc SHA-256: 506c879bf141692e29b317e054607210c2abf6812a5d9c44bfb6d2d756912498

222 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: Malicious Link T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell

The sample is identified as malicious due to multiple critical heuristic firings related to CVE-2017-0199 and CVE-2022-30190 (Follina). These indicate the document attempts to leverage an external OLE object to load a remote HTML resource from 'http://example.com/index.html!'. This mechanism is commonly used to download and execute further stages of malware.

Heuristics 6

CVE-2022-30190 — Follina stage-1 external HTML oleObject critical CVE likely CVE_2022_30190

External OLEObject relationship targets a remote .html with the Follina delivery shape (oleObject -> HTTP(S) HTML with trailing Moniker '!'). In live Follina samples the ms-msdt: trigger is served by the remote HTML, not the document itself.
OOXML OLE2Link remote loader — CVE-2017-0199 related high CVE related CVE_2017_0199_RELATED

Document contains an o:OLEObject Type=Link whose external oleObject relationship points to a remote URL. This is the OOXML OLE2Link activation shape associated with CVE-2017-0199 delivery, but the local file does not expose URL Moniker bytes or a weaponized extension/content type, so the exact CVE cannot be proven statically.
ClamAV: Win.Exploit.CVE_2022_30190-9951234-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Exploit.CVE_2022_30190-9951234-1
External OLE object relationship high OOXML_EXTERNAL_OLE_OBJECT

Document contains an oleObject relationship whose target is an external HTTP(S) URL. Office resolves this through OLE/object update paths rather than as a normal user-clicked hyperlink.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape
- http://example.com/index.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `6f7aadbed8c72ad7cbaac765d9b25a8d177778ef8180252575ad36711d4df17c`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	3072 bytes
`ooxml_oleobject_00_ole10native_00.bin` `7750cf7580e12e25ce5864e8554d861b3a313d66154b2d132cdd1503b17e34cf`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.