Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 99b2818d0103f2a8…

MALICIOUS

Office (OLE) / .DOC

86.5 KB Created: 2021-12-14 08:36:00 Authoring application: Microsoft Office Word First seen: 2022-05-13
MD5: ea920499b95956bde41883b8ae456e2a SHA-1: 05c632d35d5685aeebf133debb038fd74bcea4de SHA-256: 99b2818d0103f2a8b2035fbf37bf33db5e089e59fecf5b2394c770cdfe26c37a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The sample is a Microsoft Word document that exploits CVE-2017-0199 to download a secondary payload from the URL http://uupss.xyz/work/doc/Zapytanie_ofertowe_sig_052022(4971).doc. The document body contains this URL, disguised as a 'ZAPYTANIE OFERTOWE LINK'. This indicates a phishing or social engineering attack aiming to trick the user into downloading and executing a malicious file.

Heuristics 2

  • OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uupss.xyz/work/doc/Zapytanie_ofertowe_sig_052022(4971).doc
    • http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.