Malicious Office (OOXML) — malware analysis report

Heuristics 6

• Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
  This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
• Embedded OLE object medium OOXML_OLE_OBJECT
  Document contains an embedded OLE object
• External hyperlinks (38) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 38 external hyperlinks — clickable URLs are stored as external relationships. First target: http://en.wikipedia.org/wiki/Formaldehyde
• Payload URL recovered from embedded OLE object (11 URLs) info OOXML_EMBEDDED_OBJECT_URL
  An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.em.azcollaboration.com/Operations/biologics/GlobalEng/ProjProcess/_layouts/DocIdRedir.aspx?ID=GENG-42-266 In document text (OOXML body / shared strings)

  • http://www.dbp.org.uk/cs/DBP00207.pdfIn document text (OOXML body / shared strings)
  • https://www.em.azcollaboration.com/Operations/biologics/GlobalEng/BuiltEnv/_layouts/DocIdRedir.aspx?ID=GENG-91-43In document text (OOXML body / shared strings)
  • http://www.breeam.org/In document text (OOXML body / shared strings)
  • https://www.em.azcollaboration.com/Operations/EssExt/eng/TPS/00_PM_ALL/2 Pancras Square Sustainability Checklist.xlsDocument hyperlink
  • https://www.em.azcollaboration.com/Operations/EssExt/eng/TPS/00_PM_ALL/2 Pancras Ergonomics Checklist.docxDocument hyperlink
  • http://schemas.open����In document text (OOXML body / shared strings)
  • http://schemas.micrPIn document text (OOXML body / shared strings)
  • http://schemas.micrWIn document text (OOXML body / shared strings)
  • http://portalapps.is.astrazeneca.net/azgard-components/ldms-documents/global_she/effective/GlobalIn document text (OOXML body / shared strings)
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.1b34afba7cd5b0e1128ba51010108a0c/?vgnextoid=df95e973c8212210VgnVCM2000003401920aRCRDIn document text (OOXML body / shared strings)
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.1b34afba7cd5b0e1128ba51010108a0c/?vgnextoid=ebc27f2330562210VgnVCM1000003301920aRCRDIn document text (OOXML body / shared strings)
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.1a05ec339a64a0e1128ba51010108a0c/?vgnextoid=e61402d897951210VgnVCM2000003401920aRCRDIn document text (OOXML body / shared strings)
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.1a05ec339a64a0e1128ba51010108a0c/?vgnextoid=e61402d897951210VgnVCM2000003401920aRCRDZIn document text (OOXML body / shared strings)
  • http://www.usgbc.org/DisplayPage.aspx?CategoryID=19In document text (OOXML body / shared strings)
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.1b34afba7cd5b0e1128ba51010108a0c/?vgnextoid=2d027f2330562210VgnVCM1000003301920aRCRDIn document text (OOXML body / shared strings)
  • http://en.wikipedia.org/wiki/FormaldehydeDocument hyperlink
  • http://en.wikipedia.org/wiki/ChlorobenzenesDocument hyperlink
  • http://en.wikipedia.org/wiki/LeadDocument hyperlink
  • http://en.wikipedia.org/wiki/Polyvinyl_chlorideDocument hyperlink
  • http://en.wikipedia.org/wiki/CreosoteDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=c457a102f7b5d210VgnVCM2000003401920aRCRDDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=ddbe87c77da5d210VgnVCM1000003301920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/Bisphenol_ADocument hyperlink
  • http://en.wikipedia.org/wiki/ChlorodifluoromethaneDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=66eb4c50a865d210VgnVCM2000003401920aRCRDDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=f86881b2b4b5d210VgnVCM1000003301920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/HypalonDocument hyperlink
  • http://en.wikipedia.org/wiki/Chromium_VIDocument hyperlink
  • http://en.wikipedia.org/wiki/Flame_retardantDocument hyperlink
  • http://en.wikipedia.org/wiki/Perfluorinated_compoundDocument hyperlink
  • http://en.wikipedia.org/wiki/Volatile_organic_compoundsDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=aedb91aa9cb5d210VgnVCM2000003401920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/AsbestosDocument hyperlink
  • http://en.wikipedia.org/wiki/NeopreneDocument hyperlink
  • http://en.wikipedia.org/wiki/Chlorinated_paraffinsDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=029af3a51832e210VgnVCM1000003301920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/PolyethyleneDocument hyperlink
  • http://en.wikipedia.org/wiki/Polychlorinated_biphenylsDocument hyperlink
  • http://en.wikipedia.org/wiki/PentachlorophenolDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=0259f3a51832e210VgnVCM1000003301920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/AlkylphenolsDocument hyperlink
  • http://en.wikipedia.org/wiki/CadmiumDocument hyperlink
  • http://en.wikipedia.org/wiki/ChloropreneDocument hyperlink
  • http://en.wikipedia.org/wiki/Mercury_(elementDocument hyperlink
  • http://en.wikipedia.org/wiki/Polyvinylidene_chlorideDocument hyperlink
  • http://youraz.astrazeneca.net/portal/site/AZ/menuitem.973a3a2a8d5bd1f5e8a77d1010108a0c/?vgnextoid=24ea6e8c4d55d210VgnVCM1000003301920aRCRDDocument hyperlink
  • http://en.wikipedia.org/wiki/ArsenicDocument hyperlink
  • http://en.wikipedia.org/wiki/ChlorofluorocarbonsDocument hyperlink
  • http://en.wikipedia.org/wiki/Chlorinated_polyvinyl_chlorideDocument hyperlink

  +32 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.