Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 a6cb9560712a7102…

MALICIOUS

Office (OOXML) / .DOC

24.1 KB Created: 2021-05-01 10:59:00 UTC Authoring application: Microsoft Office Word 12.0000
MD5: 1e43f1b3b70800f2aa497a63392f42fd SHA-1: 7986aa48fdc87f509f93b0ae877aa534f2ef813d SHA-256: a6cb9560712a71029c600d972e00b9656d63bcfd0494f0c63e63e4489231774f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The primary heuristic indicates an advance-fee scam, suggesting the document's content is designed to trick the user into paying money or providing sensitive information. The presence of a callback lure further supports a phishing or social engineering attack. No executable scripts or malicious URLs were extracted, limiting the IOCs to the document itself.

Heuristics 3

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml

Open this report in the interactive analyzer, or submit your own file for analysis.