Office (OOXML) / .DOC malware analysis — malicious · 9f7ef8d16861b56b

MALICIOUS

Office (OOXML) / .DOC

274.4 KB Created: 2022-08-14 17:44:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2022-08-15

MD5: b8ee52d8fb3b3e51606bd8374350f91f SHA-1: f7e37ce1ae88ddf24e813e5bad76d2da288ebf2d SHA-256: 9f7ef8d16861b56b9f600237e4a883ba0e4b73f25be2a51e8c4ea3aba3740f47

84 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1129 Execution through API

The file is a malicious OOXML document containing an embedded OLE object. Heuristics indicate that this OLE package is designed to drop an auto-executable payload, specifically noting a '.jar' extension. This suggests the document's primary function is to deliver and execute a secondary malicious payload.

Heuristics 4

Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `60538ee0bf939071546c37ff70e7bcacfd4733bee6c49ee7f6e328cc846ff1bb`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	183808 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.97, consistent with packed or encrypted content.
`ooxml_oleobject_00_ole10native_00.bin` `7a0f625a67418f2c5cb986731351a59fd03874736db44582022ca3e89bfeddfe`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	179445 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.
`emf_00.emf` `3656df44057142b375e5f147539747b96ecc092d987b8f5657871d3feab4dc98`	ooxml-emf	OOXML EMF part: word/media/image3.emf	5464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.