Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 7b53f972c7650851…

MALICIOUS

Office (OOXML) / .DOCX

250.7 KB
MD5: 2d0ae7c8afe89da171e806d093361315 SHA-1: 282325d3d41de9a13957e031e911116059d4668d SHA-256: 7b53f972c7650851cafcb03440480cd71fb27b931874bd38f2eaaf1ccf0d1ac7
300 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1137.003 DLL Search Order Hijacking T1204.002 Malicious File

The OOXML document utilizes an altChunk to import an RTF file named 'Argentina.rtf'. This RTF file contains OLE objects that are triggered by \objupdate, leading to the execution of an embedded PE file. The presence of RTF_MZ_HEX and RTF_COMPOSITE_MONIKER_RELATED heuristics confirms the embedding and activation of an executable. This indicates a delivery mechanism designed to bypass initial detection by embedding a malicious payload within a seemingly benign document.

Heuristics 8

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    (in altChunk RTF word/Argentina.rtf) RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF
    Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    (in altChunk RTF word/Argentina.rtf) Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • altChunk RTF auto-updates embedded executable object critical OOXML_ALTCHUNK_RTF_AUTOUPDATE_PE
    OOXML document imports an embedded RTF through altChunk; the RTF contains OLE object data, forces object update, and carries a hex-encoded PE payload. This is a stronger compound exploit-loader shape than a generic altChunk RTF wrapper, but it is not tied to a single CVE unless the nested RTF object primitive also matches one.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    (in altChunk RTF word/Argentina.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    (in altChunk RTF word/Argentina.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    (in altChunk RTF word/Argentina.rtf) RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://opendope.org/xpaths
    • http://opendope.org/conditions
    • http://opendope.org/questions
    • http://opendope.org/components
    • http://opendope.org/SmartArt/DataHierarchy
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.openxmlformats.org/schemaLibrary/2006/main
    • http://schemas.openxmlformats.org/drawingml/2006/chart
    • http://schemas.openxmlformats.org/drawingml/2006/chartDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/diagram
    • http://schemas.openxmlformats.org/drawingml/2006/picture
    • http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
    • http://schemas.microsoft.com/office/drawing/2008/diagram
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliography
    • http://schemas.openxmlformats.org/drawingml/2006/compatibility
    • http://schemas.openxmlformats.org/drawingml/2006/lockedCanvas

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003a12.bin
8363491ebd06495017b88fbbeca06e329343b6a54a5a26db78a6448b4af45145		 rtf-objdata-decoded RTF \objdata at offset 0x3A12 495698 bytes
objdata_01_off001012e8.bin
e539d8029fe2b7893811042018fe1688eb9adee8f598c3b3ad988d8e35716fcc		 rtf-objdata-decoded RTF \objdata at offset 0x1012E8 533979 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.