Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 8af3f57161e7bf59…

MALICIOUS

Office (OLE) / .DOC

82.0 KB Created: 2020-12-08 09:36:00 Authoring application: Microsoft Office Word
MD5: 954f103759f33bdb06cb42d3c0c65ad8 SHA-1: 65243fa1653e628707abc3ec9fcdf20a901397fc SHA-256: 8af3f57161e7bf59754c0738e3f3a221adaadd40ad3b96eca97f14ff260f3856
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document body clearly exhibits characteristics of an advance-fee scam, instructing the recipient to provide sensitive banking information to claim a fictitious lottery prize. The presence of specific email addresses and a phone number associated with the purported prize transfer manager are the primary indicators for this lure. No VBA macros were extractable due to an unsupported format, limiting further analysis of potential malicious code execution.

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main