Office (OOXML) / .DOCX malware analysis — suspicious · 6a5a6090433359cc

SUSPICIOUS

Office (OOXML) / .DOCX

44.4 KB Created: 2019-09-28 21:35:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-05-11

MD5: 3e2237dc93768ac1d9158704f5f3665e SHA-1: b89e9ab589b8dc151961c4cb006be24218aa7a0c SHA-256: 6a5a6090433359cc2ad1e94c7632513122652f2602f24f614ece4528625bc2ea

50 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document contains external hyperlinks, one of which points to a suspicious URL hosted on AWS. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be instructing the user to decrypt a password-protected archive, a common tactic to bypass security filters. The document body text, while appearing benign, is likely a distraction from the malicious intent of the embedded link.

Heuristics 3

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS

Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: https://t.umblr.com/redirect?z=https://mustekenpro.s3-us-west-2.amazonaws.com/mamamuda&t=ZDljM2VhMmQ4Mzc1YWI4M2NiZmQ0NzViZmY1ZDdhYTdhOTRlZDM5MywyODgzNTQ2YTIyZTY
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- https://t.umblr.com/redirect?z=https://mustekenpro.s3-us-west-2.amazonaws.com/mamamuda&t=ZDljM2VhMmQ4Mzc1YWI4M2NiZmQ0NzViZmY1ZDdhYTdhOTRlZDM5MywyODgzNTQ2YTIyZTY0MjBkZTZiZGE2OTJkNzNlNjU3ZDgzNWU5YmJjDocument hyperlink
- https://t.umblr.com/redirect?z=https://mustekenpro.s3-us-west-2.amazonaws.com/mamamuda&t=ZDljM2VhMmQ4Mzc1YWI4M2NiZmQ0NzViZmY1ZDdhYTdhOTRlZDM5MywyODgzNTQ2YTIyZTYDocument hyperlink

Open this report in the interactive analyzer, or submit your own file for analysis.