Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d77727b874df050c…

MALICIOUS

Office (OLE)

45.5 KB Created: 2017-10-05 19:03:00 Authoring application: Microsoft Office Word First seen: 2018-01-23
MD5: eddd23b70912c8f4bfac5fcb395415a0 SHA-1: 1076307dea108575f27dad55e7c5b33e9f844908 SHA-256: d77727b874df050c430840039263faaf9190264f42cf5485df791599ec7f0a97
62 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample contains a weaponized URL associated with CVE-2017-0199, indicating an attempt to exploit this vulnerability. The embedded URL points to a HTA file, which is likely a second-stage payload. The document body is heavily obfuscated and does not provide further clues on the specific intent.

Heuristics 2

  • OLE2Link / URL Moniker weaponized URL — CVE-2017-0199 critical CVE exact CVE_2017_0199_WEAPONIZED_URL
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fasttradeco.com/style/js/hosting1986desktop.hta In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.