Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 a7b30313fb5dd45c…

MALICIOUS

Office (OOXML) / .DOC

10.9 KB Created: 2021-06-11 13:07:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2023-07-07
MD5: cbda0a02138186392f38d14d8ccf8a15 SHA-1: 4ae49bf16622eecd877f0d4de0552a73d1771dd7 SHA-256: a7b30313fb5dd45c467a092c666c2d82a554702cc92f362b5c5ba6c4a6b0f239
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1559 Component Object Model Hijacking

The OOXML document contains heuristics indicating remote template injection and external relationships, pointing to an attempt to load content from an external source. The embedded URL https://zyp.to/d6wvg is the primary indicator of this malicious activity. The document body itself does not contain user-facing text, suggesting the malicious content is loaded via the external relationship.

Heuristics 3

  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (https://zyp.to/d6wvg) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: https://zyp.to/d6wvg
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zyp.to/d6wvg
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml

Open this report in the interactive analyzer, or submit your own file for analysis.