Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 897ee7659b61315c…

MALICIOUS

Office (OOXML) / .DOCX

250.6 KB
MD5: 3ccb7b1100bea511205b4c2e23695a93 SHA-1: a4e01a3333528873a16146269c1795d2cd36bc21 SHA-256: 897ee7659b61315c82b5d89f9a7d4297f2840b54da61efb9ae543f35e2517f63
300 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The OOXML document contains an altChunk that imports an RTF file. This RTF file contains OLE objects that are automatically updated and executed, indicated by RTF_OBJDATA, RTF_OBJEMB, RTF_OBJUPDATE, and RTF_COMPOSITE_MONIKER_RELATED heuristics. The RTF_MZ_HEX and OOXML_ALTCHUNK_RTF_AUTOUPDATE_PE heuristics confirm that the imported RTF contains and auto-updates an embedded executable. This suggests the document is a delivery mechanism for a malicious payload.

Heuristics 8

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    (in altChunk RTF word/Austria.rtf) RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF
    Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    (in altChunk RTF word/Austria.rtf) Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • altChunk RTF auto-updates embedded executable object critical OOXML_ALTCHUNK_RTF_AUTOUPDATE_PE
    OOXML document imports an embedded RTF through altChunk; the RTF contains OLE object data, forces object update, and carries a hex-encoded PE payload. This is a stronger compound exploit-loader shape than a generic altChunk RTF wrapper, but it is not tied to a single CVE unless the nested RTF object primitive also matches one.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    (in altChunk RTF word/Austria.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    (in altChunk RTF word/Austria.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    (in altChunk RTF word/Austria.rtf) RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://opendope.org/xpaths
    • http://opendope.org/conditions
    • http://opendope.org/questions
    • http://opendope.org/components
    • http://opendope.org/SmartArt/DataHierarchy
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.openxmlformats.org/schemaLibrary/2006/main
    • http://schemas.openxmlformats.org/drawingml/2006/chart
    • http://schemas.openxmlformats.org/drawingml/2006/chartDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/diagram
    • http://schemas.openxmlformats.org/drawingml/2006/picture
    • http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
    • http://schemas.microsoft.com/office/drawing/2008/diagram
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliography
    • http://schemas.openxmlformats.org/drawingml/2006/compatibility
    • http://schemas.openxmlformats.org/drawingml/2006/lockedCanvas

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003a12.bin
6f6c2a54211a7ca3d8020884bda8c3a6e4fff620cd6764420945cc331d030f1d		 rtf-objdata-decoded RTF \objdata at offset 0x3A12 495698 bytes
objdata_01_off001012e8.bin
e539d8029fe2b7893811042018fe1688eb9adee8f598c3b3ad988d8e35716fcc		 rtf-objdata-decoded RTF \objdata at offset 0x1012E8 533979 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.