Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8766a06ab61acb1e…

MALICIOUS

Office (OOXML)

26.5 KB Created: 2014-04-24 10:31:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-03-18
MD5: 51f0ae9ab1013dac8e0ced90b1274185 SHA-1: 1065fb2c58cba0c4436999edb8d80fb4144fc88e SHA-256: 8766a06ab61acb1e237a655395233087820c0bcd2f24c04787899d92b898d729
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample exhibits multiple high-severity heuristics indicating the use of external OLE objects and remote template injection. Specifically, it references http://finance/Documents/Month_End/2013 14/March 14/OB Report/Surinder_test.xlsx!Sheet1!R1C1:R2C5 and http://finance/Documents/Forms/Word/Centro_Document.dotx. These findings suggest the document is designed to exploit vulnerabilities or trick the user into loading external content, likely leading to the execution of a secondary payload. The presence of an embedded EMF artifact further supports the malicious nature of the file.

Heuristics 5

  • OOXML OLE2Link remote loader — CVE-2017-0199 related high CVE related CVE_2017_0199_RELATED
    Document contains an o:OLEObject Type=Link whose external oleObject relationship points to a remote URL. This is the OOXML OLE2Link activation shape associated with CVE-2017-0199 delivery, but the local file does not expose URL Moniker bytes or a weaponized extension/content type, so the exact CVE cannot be proven statically.
  • External OLE object relationship high OOXML_EXTERNAL_OLE_OBJECT
    Document contains an oleObject relationship whose target is an external HTTP(S) URL. Office resolves this through OLE/object update paths rather than as a normal user-clicked hyperlink.
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (http://finance/Documents/Forms/Word/Centro_Document.dotx) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: http://finance/Documents/Forms/Word/Centro_Document.dotx
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://finance/Documents/Month_End/2013 14/March 14/OB Report/Surinder_test.xlsx!Sheet1!R1C1:R2C5 In document text (OOXML body / shared strings)
    • http://finance/Documents/Month_End/2013In document text (OOXML body / shared strings)
    • http://finance/Documents/Forms/Word/Centro_Document.dotxRemote template reference
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 3788 bytes
SHA-256: c35c75e9e26a1c07aa9e2598cd8ce499b2a264067b96c6fa803c392583269cd4

Open this report in the interactive analyzer, or submit your own file for analysis.