Dridex — Office (OOXML) malware analysis

Static analysis result for SHA-256 63684693e58c13ca…

MALICIOUS

Office (OOXML)

195.8 KB Authoring application: 14.0300
MD5: 19d9443a09814983665a60b7017f6494 SHA-1: 5aece46d701fc1d72b8d9253dd617fa1827cd988 SHA-256: 63684693e58c13ca45fc8aba17b2255bbec85912dae030593660e5b26220f7e6
142 Risk Score

Malware Insights

Dridex · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is detected as Xls.Downloader.TrendMicroDridex0521-9860965-0 by ClamAV, indicating a Dridex downloader. The document body contains strings like 'rundll32.exe', 'ADODB.Stream', 'Wscript.Shell', and 'MSXML2.XMLHTTP', along with multiple URLs, suggesting an attempt to download and execute a second-stage payload. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' further supports the idea that the user is being prompted to execute commands, likely involving these components.

Heuristics 4

  • ClamAV: Xls.Downloader.TrendMicroDridex0521-9860965-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.TrendMicroDridex0521-9860965-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://damonica.com/webedit_includes/de/skins/default/m7OPEeyiZzqD.php
    • https://tafaghodi.ir/resume/files/OKBWIjkslY8bOV.php
    • https://website-demo.co.in/jthealthcare/wp-includes/css/dist/block-editor/KnSlPIeZi.php
    • https://radiouranio.com/player_radio/jquery.lightbox/js/lightbox/themes/zagDA4cqUZOj.php
    • https://hereweads.com/wp-content/plugins/woodmart-core/woodmart-core/importer/UZIk36xnY.php
    • https://kpleads.com/kpleads.ali/wp/wp-includes/js/codemirror/FA0MND35N.php
    • https://loveworldprograms.org/videos/fontawesome/css/FHK2joBPEd.php
    • https://momentsjo.com/COPYRIGHT/fUK6TkrF5j2dFc.php

Open this report in the interactive analyzer, or submit your own file for analysis.