Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 b41c77a8619909fd…

MALICIOUS

Office (OOXML) / .DOCX

477.4 KB Created: 2021-08-04 12:45:00 UTC Authoring application: Microsoft Office Word 12.0000
MD5: 020e72af55ac11dcdaba8f481bf7b60a SHA-1: 7e41b3c0426b63f5f6e19a98603e549c52b208de SHA-256: b41c77a8619909fd51a4208beb6f69e880ef49ac7bfdf0844b948c6370d9b85f
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample utilizes an OOXML_ALTCHUNK_RTF heuristic, indicating it imports an external RTF document. This RTF document contains OLE objects that are automatically linked and updated via RTF_OBJAUTLINK and RTF_OBJUPDATE rules, suggesting an attempt to exploit Office vulnerabilities. The presence of a remote template injection (OOXML_REMOTE_TEMPLATE) points to the URL https://my.dexserver.com/assets/css/dotms_4/SFiukJmBghbBZiamuoSb.dotm as a source for malicious content. The overall mechanism suggests a document-based exploit designed to download and execute further payloads.

Heuristics 8

  • altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF
    Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    (in altChunk RTF word/altChunk1.rtf) RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    (in altChunk RTF word/altChunk1.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Remote template injection high OOXML_REMOTE_TEMPLATE
    Document references a remote template URL (https://my.dexserver.com/assets/css/dotms_4/SFiukJmBghbBZiamuoSb.dotm) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
  • OLE object data medium RTF_OBJDATA
    (in altChunk RTF word/altChunk1.rtf) RTF contains 1 \objdata section(s) — embedded OLE objects
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/settings.xml.rels: https://my.dexserver.com/assets/css/dotms_4/SFiukJmBghbBZiamuoSb.dotm
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://my.dexserver.com/assets/css/dotms_4/SFiukJmBghbBZiamuoSb.dotm
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000078f1.bin
095891486a3baa1df5bd3e0707daa3ff07997866c711b2f61740832479fdd41d		 rtf-objdata-decoded RTF \objdata at offset 0x78F1 76128 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.79, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.