MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
The OOXML_REMOTE_TEMPLATE heuristic fired, indicating the document is configured to load content from the URL https://ln24.ir/n2KJQK. This is a common technique for delivering secondary payloads or initiating phishing attacks. The presence of a standalone relationship file also suggests a potentially unusual or malicious structure.
Heuristics 2
-
Remote template injection high OOXML_REMOTE_TEMPLATEStandalone relationship XML references a remote template URL (https://ln24.ir/n2KJQK). This is the same attachedTemplate/template relationship shape used for remote-template injection in OOXML packages.URL https://ln24.ir/n2KJQK
-
Standalone OOXML relationship file medium OOXML_STANDALONE_RELSFile is raw OOXML relationship XML rather than a valid OOXML ZIP package. This malformed Office-extension payload still declares an external relationship and should be reviewed as relationship-based Office content.URL https://ln24.ir/n2KJQK
- http://schemas.openxmlformats.org/package/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate
Open this report in the interactive analyzer, or submit your own file for analysis.