Office (OOXML) / .DOCX malware analysis — malicious · d59cfc669b3b5a79

MALICIOUS

Office (OOXML) / .DOCX

622.5 KB

MD5: 58b5e99f3ca24a9b9bbbb91b4b32c8d3 SHA-1: 1e87f6aaa97be8d26188af925e8826462cf4371d SHA-256: d59cfc669b3b5a79d419892724b07aa56e871f55b239e77cb991f90f5a9ca181

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information T1137.003 DLL Search Order Hijacking

The OOXML document contains an altChunk that imports an external RTF file ('word/Mongolia.rtf'). This RTF file contains embedded OLE objects, and the presence of the RTF_OBJUPDATE heuristic indicates that these objects are likely designed to be activated automatically. The RTF_EXCESSIVE_HEX heuristic suggests obfuscation within these objects. This technique is commonly used to deliver and execute malicious payloads, such as shellcode or executables, by exploiting OLE object activation mechanisms.

Heuristics 6

altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF

Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
\objupdate forces OLE activation high RTF_OBJUPDATE

(in altChunk RTF word/Mongolia.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

(in altChunk RTF word/Mongolia.rtf) RTF contains ~2817KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

(in altChunk RTF word/Mongolia.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

(in altChunk RTF word/Mongolia.rtf) RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://opendope.org/xpaths
- http://opendope.org/conditions
- http://opendope.org/questions
- http://opendope.org/components
- http://opendope.org/SmartArt/DataHierarchy
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/main
- http://schemas.openxmlformats.org/schemaLibrary/2006/main
- http://schemas.openxmlformats.org/drawingml/2006/chart
- http://schemas.openxmlformats.org/drawingml/2006/chartDrawing
- http://schemas.openxmlformats.org/drawingml/2006/diagram
- http://schemas.openxmlformats.org/drawingml/2006/picture
- http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
- http://schemas.microsoft.com/office/drawing/2008/diagram
- http://schemas.openxmlformats.org/officeDocument/2006/bibliography
- http://schemas.openxmlformats.org/drawingml/2006/compatibility
- http://schemas.openxmlformats.org/drawingml/2006/lockedCanvas

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003a12.bin` `cd112ffe35b2485f688a47bb6eaaa77907558ac780c28848c6024bca4ca1249d`	rtf-objdata-decoded	RTF \objdata at offset 0x3A12	1420905 bytes
`objdata_01_off002c4737.bin` `cfdb4a077c5f246e92e6322395cebc5a3dcf8a28c92ec8882aadb5231c9a8a69`	rtf-objdata-decoded	RTF \objdata at offset 0x2C4737	584266 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.