Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c14a69576cfc77cb…

MALICIOUS

Office (OOXML)

729.5 KB Created: 2009-01-12 04:54:15 UTC Authoring application: Microsoft Office PowerPoint 12.0000 First seen: 2016-06-08
MD5: 2530b78941e53121629ea97081b99508 SHA-1: 6b417e6a9362be7ff207349281756aabd6a44f29 SHA-256: c14a69576cfc77cb2680b4ff0592882902be3f7e7844c1d6cc7bd31b3c4a8227
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Html.Spyware.IMG-6. The document body contains text that encourages the user to forward a religious message, promising blessings and prosperity, which is a common social engineering lure. It also contains embedded URLs, two of which are not confirmed as benign, suggesting potential redirection or spamming activity.

Heuristics 2

  • ClamAV: Html.Spyware.IMG-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Html.Spyware.IMG-6
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.elcaminante.ve.tc In document text (OOXML body / shared strings)
    • http://www.ciudad.com.ar/ar/popunder/p_submit.asp?site=personales.ciudad.com.arIn document text (OOXML body / shared strings)
    • http://www.iec.chIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/iX/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
emf_00.emf ooxml-emf OOXML EMF part: ppt/media/image2.emf 4528 bytes
SHA-256: ad250b61198afb7bc325a6f7b311003882419a679cd0b0eedbe086e57ef3ce93

Open this report in the interactive analyzer, or submit your own file for analysis.