Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 c5764991a75a9d7a…

MALICIOUS

Office (OOXML) / .DOC

2.20 MB Created: 2024-05-28 15:56:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 97d902e03f8ce3c4a18b7a346f61d3ef SHA-1: a04c1d6e52522d696b9eb0ae06af50ce0a5aa534 SHA-256: c5764991a75a9d7aa727cd2b93b475d6ad11d91ba3797461618494f4759f9011
228 Risk Score

Malware Insights

MITRE ATT&CK
T1218 System Binary Proxy Execution T1059 Command and Scripting Interpreter T1071 Application Layer Protocol

The document contains multiple high-risk lures, including instructions to execute commands via the clipboard or visible LOLBins, and requests for recovery secrets or private keys. It also suggests a remote support tool pretext. The external hyperlink points to a suspicious URL, likely a lure for further compromise. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution mechanisms.

Heuristics 7

  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • External hyperlinks (57) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 57 external hyperlinks — clickable URLs are stored as external relationships. First target: https://1-rt--solar-ru.translate.goog/upload/medialibrary/079/8oqqn6556g1o61ez0uf4ovura0fdv3na/image009.png?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=w
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://t-solar.ru/solar-4rays/blog/433/
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.microsoft.com/office/2019/extlst
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahash
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • https://1-rt--solar-ru.translate.goog/solar-4rays/blog/4333/?_x_tr_enc=1&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp

Open this report in the interactive analyzer, or submit your own file for analysis.