Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c574d60056aca80d…

MALICIOUS

Office (OOXML)

3.49 MB Created: 2016-12-12 18:38:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2019-06-27
MD5: 12fa6a3fd811e440beafca7a8f35b9f2 SHA-1: 3ad568075afbf8f2881d7b4fe6bac489eb8900f0 SHA-256: c574d60056aca80d9fa02ccdb523265b01917e2b621464351e2a72810ce20e0b
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains a critical DDE auto-execution heuristic indicating a malicious command. This command uses PowerShell to download a JavaScript file from 'https://u.lewd.se/BdQCPL_index.js' and save it as '%tmp%/index.js'. The document body contains commercial text, likely a lure, and an external hyperlink to a Gmail address, which is also listed as an IOC. The primary attack vector is likely spearphishing attachment, leading to client execution via the DDE command.

Heuristics 5

  • ClamAV: Doc.Exploit.DDEautoexec-6346603-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.DDEautoexec-6346603-1
  • Malicious DDE command critical OOXML_DDE_MALICIOUS
    DDE field in word/document.xml launches a dangerous executable: \\System32\\cmd.exe
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: mailto:fromcolombiacancun@gmail.com
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://u.lewd.se/BdQCPL_index.js Document hyperlink
    • https://u.lewd.se/EG0Hcr_documento.jsDocument hyperlink
    • http://cipa.jp/exif/1.0/Document hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasDocument hyperlink
    • http://schemas.openxmlformats.org/markup-compatibility/2006Document hyperlink
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsDocument hyperlink
    • http://schemas.openxmlformats.org/officeDocument/2006/mathDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingDocument hyperlink
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingDocument hyperlink
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkDocument hyperlink
    • http://schemas.microsoft.com/office/word/2006/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeDocument hyperlink
    • http://commons.wikimedia.org/wiki/File:Tulum_-_16.jpg��Document hyperlink
    • http://www.iec.chDocument hyperlink
    • http://ns.adobe.com/xap/1.0/Document hyperlink
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Document hyperlink
    • http://ns.adobe.com/xap/1.0/mm/Document hyperlink
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#Document hyperlink
    • http://ns.adobe.com/exif/1.0/aux/Document hyperlink
    • http://purl.org/dc/elements/1.1/Document hyperlink
    • http://ns.adobe.com/photoshop/1.0/Document hyperlink
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Document hyperlink
    • http://ns.adobe.com/camera-raw-settings/1.0/Document hyperlink
    • http://ns.adobe.com/tiff/1.0/Document hyperlink
    • http://ns.adobe.com/exif/1.0/Document hyperlink

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.