Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8fe2947c9977aab1…

MALICIOUS

Office (OLE)

93.5 KB Created: 2017-08-29 21:48:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: 9db8dec9b72447f954f5b28a08dcf4a1 SHA-1: c5c4204a73397497e2ac1d5c4daaec151009592f SHA-256: 8fe2947c9977aab17c143ee3525ad652b16af46a9907b2c2d3f09e4972b464ec
102 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample exploits CVE-2017-0199, a known vulnerability for remote code execution, by embedding a URL that points to a malicious HTA file. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may also be part of a multi-stage attack involving password-protected archives. The embedded URL is the primary indicator of compromise.

Heuristics 3

  • OLE2Link / URL Moniker weaponized URL — CVE-2017-0199 critical CVE exact CVE_2017_0199_WEAPONIZED_URL
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://enginetop.website/bawsy/1234567890123456789.hta In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.