Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 978b74c834f6141f…

MALICIOUS

Office (OLE)

49.5 KB Created: 2017-10-05 19:03:00 Authoring application: Microsoft Office Word First seen: 2017-10-28
MD5: e6c4dd6d68b7776c0f7cf25167b3349f SHA-1: 1229f1e8f928573e6363323c33206774e108d674 SHA-256: 978b74c834f6141f2478f0587a5cfdf7a534a25824495cd78c1420034bc64def
62 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample contains a weaponized URL associated with CVE-2017-0199, indicating an attempt to exploit this vulnerability. The embedded URL points to a HTA file, which is likely a second-stage payload. The document body is heavily obfuscated and does not provide clear instructions, but the heuristic firing strongly suggests the intent is to download and execute the HTA file.

Heuristics 2

  • OLE2Link / URL Moniker weaponized URL — CVE-2017-0199 critical CVE exact CVE_2017_0199_WEAPONIZED_URL
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fasttradeco.com/style/js/hosting1986desktop.hta In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.