Office (OOXML) malware analysis — malicious · a8441305014e11c3

MALICIOUS

Office (OOXML)

538.2 KB Created: 2021-03-13 22:26:43 UTC Authoring application: 12.0000 First seen: 2021-04-01

MD5: 90ac7c604add2c00ff9c1e9a59aa7865 SHA-1: 49e9da265b1dbc1955a245337d5de748439a7696 SHA-256: a8441305014e11c3486b365777c62c43f2cd4a2d1e4ab9dc62c655d739633ccf

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an Office document containing an embedded OLE object. This object is identified as a risky file package that drops an auto-executable payload named 'FRCR registration unlocker.exe'. The document body text also references this unlocker, suggesting a lure to trick the user into interacting with the embedded malicious executable.

Heuristics 3

Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: ppt/embeddings/oleObject2.bin	148992 bytes
SHA-256: `919aac4eaef506f2f5adedeb410a0b16cd239ef28835573e386e60e59fac9fa4`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.69, consistent with packed or encrypted content.
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML ppt/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	146313 bytes
SHA-256: `35eccff30823cc92eece80c55087c889746a255d30329b0eb8294868032d4dda`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.72, consistent with packed or encrypted content.
`ooxml_oleobject_00_ole10native_00_FRCR_registration_unlocker_2.exe`	ole-package-payload	OOXML ppt/embeddings/oleObject2.bin Ole10Native payload: display_name=; full_path=C:\Users\memo\AppData\Local\Temp\FRCR registration unlocker (2).exe; temp_path=; def_file=	145920 bytes
SHA-256: `92d2607f374d8ebc2b8fa8fbbd9e7fbd78e4032d13643ce62929f964a73a0791`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.72, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.