Office (OOXML) / .DOC malware analysis — malicious · b82179a96d47de86

MALICIOUS

Office (OOXML) / .DOC

809.6 KB Created: 2025-12-01 09:03:00 UTC Authoring application: Microsoft Office Word 12.0000

MD5: 984ae4f139b7da1574a57501061e1eff SHA-1: e9704ce3abcd5740f6e61bde877a14137704366a SHA-256: b82179a96d47de86e60ba65ca7ce97f6424f08e637c5e4127c6c08021c417d8f

82 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File

The OOXML_REMOTE_TEMPLATE and OOXML_EXTERNAL_REL heuristics indicate that the document is configured to load external content, likely to exploit a vulnerability. The embedded URL points to a suspicious domain, suggesting it is used to fetch a secondary payload. The presence of embedded OLE objects further supports the malicious intent, as these can be used to deliver exploits or additional malware.

Heuristics 5

Remote template injection high OOXML_REMOTE_TEMPLATE

Document references a remote template URL (https://／＼／＼／＼／＼／＼／＼／＼／＼／＼@yorl.to/Lmtx?&／＼／＼／＼／＼／＼／＼／＼／＼／＼／＼) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
External relationship medium OOXML_EXTERNAL_REL

External target in word/_rels/settings.xml.rels: https://／＼／＼／＼／＼／＼／＼／＼／＼／＼@yorl.to/Lmtx?&／＼／＼／＼／＼／＼／＼／＼／＼／＼／＼
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.openxmlformats.org/markup-compatibili

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `4b2d4ab8e3fbeb72499a2bbf6575e3d991d3727b06ce9dacd91df52e41ec8a3e`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject2.bin	65536 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.68, consistent with packed or encrypted content.
`ooxml_oleobject_01.bin` `555b8526c5b0e44c69bd5dd0913c25223ee3d0a0263ee828f7b4812f63260490`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	762880 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.57, consistent with packed or encrypted content.
`emf_00.emf` `00e403bd2aea65cf4a533a3648dc8fc68ee57b3d5c55ce341fb81d571ea588eb`	ooxml-emf	OOXML EMF part: word/media/image2.emf	1454420 bytes
`emf_01.emf` `85dd4ee648c157e8ecb9c898b747c959127ed10a5d4492b50047b8a5aa1281be`	ooxml-emf	OOXML EMF part: word/media/image1.emf	1505804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.