Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 9c24033de3644bcb…

MALICIOUS

Office (OOXML) / .DOCX

248.2 KB
MD5: aec7210da97a674290b4edb0573ecd1e SHA-1: ec3d12f2d1295709d912c2c05872be725c41cfb3 SHA-256: 9c24033de3644bcbffbb1eefd12667bc9c931a2063833f3b1ef53d3e01b126b2
300 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model T1137.003 DLL Search Order Hijacking T1059.001 PowerShell

The OOXML document contains an altChunk that imports an RTF file. This RTF file contains an OLE object that is triggered by an \objupdate directive. The RTF file also contains PE headers in hex data, indicating it is an executable. The altChunk RTF auto-updates and executes this embedded object, suggesting it's a downloader for a second-stage payload. The presence of OLE objects and RTF injection points towards a malicious document designed to exploit vulnerabilities or deliver malware.

Heuristics 8

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    (in altChunk RTF word/Albania.rtf) RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF
    Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    (in altChunk RTF word/Albania.rtf) Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • altChunk RTF auto-updates embedded executable object critical OOXML_ALTCHUNK_RTF_AUTOUPDATE_PE
    OOXML document imports an embedded RTF through altChunk; the RTF contains OLE object data, forces object update, and carries a hex-encoded PE payload. This is a stronger compound exploit-loader shape than a generic altChunk RTF wrapper, but it is not tied to a single CVE unless the nested RTF object primitive also matches one.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    (in altChunk RTF word/Albania.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    (in altChunk RTF word/Albania.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    (in altChunk RTF word/Albania.rtf) RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://opendope.org/xpaths
    • http://opendope.org/conditions
    • http://opendope.org/questions
    • http://opendope.org/components
    • http://opendope.org/SmartArt/DataHierarchy
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.openxmlformats.org/schemaLibrary/2006/main
    • http://schemas.openxmlformats.org/drawingml/2006/chart
    • http://schemas.openxmlformats.org/drawingml/2006/chartDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/diagram
    • http://schemas.openxmlformats.org/drawingml/2006/picture
    • http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
    • http://schemas.microsoft.com/office/drawing/2008/diagram
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliography
    • http://schemas.openxmlformats.org/drawingml/2006/compatibility
    • http://schemas.openxmlformats.org/drawingml/2006/lockedCanvas

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003a12.bin
885b9f4c90fbac83700b7d4d16c8f2e75809d957ef3bf9dfc3218be66da1ed1c		 rtf-objdata-decoded RTF \objdata at offset 0x3A12 486898 bytes
objdata_01_off000fce28.bin
11ccf1f0c5b758cc7845846fd5ed0b1b9e0b385483c39e7beffcd6aeb7d1dc4c		 rtf-objdata-decoded RTF \objdata at offset 0xFCE28 361824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.