Office (OOXML) / .DOC malware analysis — malicious · 768145a71cfb5e79

MALICIOUS

Office (OOXML) / .DOC

399.4 KB Created: 2024-10-21 10:13:00 UTC Authoring application: Microsoft Office Word 12.0000

MD5: 617529476c0ef5d4c97d2ffd9c3174ec SHA-1: 7b93fc5228bd418ff88bda1a656f64986f83f50a SHA-256: 768145a71cfb5e795f16eae18b47f0b19bbea28457848cdf7be9179f6fead136

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The OOXML document contains heuristics indicating remote template injection and an embedded OLE object, suggesting an attempt to exploit a vulnerability. The presence of a NOP sled further supports this. The remote template URL is likely used to download and execute a second-stage payload. No scripts were extracted, but the overall pattern points to a malicious document delivered via spearphishing.

Heuristics 5

NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Remote template injection high OOXML_REMOTE_TEMPLATE

Document references a remote template URL (https://keraskale.me/CSAznD?&growth=embarrassed&steam=chilly&fratricide=hilarious&shanty=typical&mound=defiant&subconscious=open&circle=syno) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
External relationship medium OOXML_EXTERNAL_REL

External target in word/_rels/settings.xml.rels: https://keraskale.me/CSAznD?&growth=embarrassed&steam=chilly&fratricide=hilarious&shanty=typical&mound=defiant&subconsci
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://keraskale.me/CSAznD?&growth=embarrassed&steam=chilly&fratricide=hilarious&shanty=typical&mound=defiant&subconscious=open&circle=syno
- https://keraskale.me/CSAznD?&growth=embarrassed&steam=chilly&fratricide=hilarious&shanty=typical&mound=defiant&subconscious=open&circle=synonymous&trapezoid
- https://keraskale.me/CSAznD?&growth=embarrassed&steam=chilly&fratricide=hilarious&shanty=typical&mound=defiant&subconsci
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2006/wordml

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `624b4f5f1b4b1fb98c1c46e9690f04af9fe28d6c93526b6ce9c1b4ef07102414`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	1604096 bytes
`ooxml_oleobject_01.bin` `5927b0d9642ec94830c3b0fa19b70b014f859e1daa4b9662cc63051cb4480d06`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Office_Excel_Worksheet1.xlsx	21698 bytes
`ooxml_oleobject_02.bin` `d37e6890f955af3f6268a1811643588d36cd8f48b70e892e6196ee93c1108efe`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/Microsoft_Office_Excel_Worksheet2.xlsx	66759 bytes
`emf_00.emf` `5194408de2c697d290ce35b0092c0bca6ca5d4c8d16f19902857f46272eccf65`	ooxml-emf	OOXML EMF part: word/media/image3.emf	615628 bytes
`emf_01.emf` `d6f06fd8927b0ade27defc90672ec3f884e50eb77d8e6fdb98ecd072e2ca7ab2`	ooxml-emf	OOXML EMF part: word/media/image1.emf	24400 bytes
`emf_02.emf` `e7d280adb02d85872013c5db5f13bc3a47c8e21792d81bf54a51abdbee655c2c`	ooxml-emf	OOXML EMF part: word/media/image2.emf	1454420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.