Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 57bed57cafe27d1d…

MALICIOUS

Office (OOXML) / .DOC

10.1 KB Created: 2018-03-07 09:39:00 UTC Authoring application: Microsoft Office Word 12.0000
MD5: e2e953661a0bbb35b12721eaada12f3f SHA-1: 1f0e8401a8b32890db8b7938cdb2c162863aa71d SHA-256: 57bed57cafe27d1dbd634fb19024d448ebeb9c7f21b72c0a4325dfcb30547ad3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution

The file is identified as malicious by ClamAV with a downloader signature. Heuristics indicate remote template injection and external relationship usage, suggesting the document is designed to fetch and execute content from an external source. The URL associated with these heuristics is a potential indicator of compromise, although it was flagged as benign in this analysis.

Heuristics 4

  • ClamAV: Doc.Downloader.Redline-9972754-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Redline-9972754-0
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (https://is.gd/QYZAE1) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/webSettings.xml.rels: https://is.gd/QYZAE1
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://is.gd/QYZAE1
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml

Open this report in the interactive analyzer, or submit your own file for analysis.