Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 8e598335d0de4438…

MALICIOUS

Office (OOXML) / .DOC

24.3 KB Created: 2020-02-25 05:41:00 UTC Authoring application: Microsoft Office Word 14.0000
MD5: 2180fa8e767676a6802cf3d5d23ea6de SHA-1: e28de511be503cf6ed5d378689d36c0cbcfb02c8 SHA-256: 8e598335d0de4438b80d8e5b63a6929d16ca67e2a5f6c567e84ea5152c5f9b15
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The sample utilizes OOXML remote template injection, indicating an attempt to download and execute content from an external URL. The embedded URL 'http://lodus.freedynamicdns.org/home/www/tiQzlt.dot' is highly suspicious and likely serves as a lure for malicious content. No scripts were extracted, limiting further analysis of the payload.

Heuristics 3

  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (http://lodus.freedynamicdns.org/home/www/tiQzlt.dot) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: http://lodus.freedynamicdns.org/home/www/tiQzlt.dot
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://schemas.microsoft.com/

Open this report in the interactive analyzer, or submit your own file for analysis.