Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 248296cf75065c7d…

MALICIOUS

Office (OOXML) / .DOCX

791.5 KB Created: 2021-09-15 09:19:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 000c10fef5a643bd96da7cf3155e6a38 SHA-1: 9253df019b02e409ac86f9241781b4d1890d3489 SHA-256: 248296cf75065c7db51a793816d388ad589127c40fddef276e622a160727ca29
220 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1559.002 Component Object Model

The sample is a malicious OOXML document that leverages CVE-2021-40444 to load an external OLE object from the URL http://212.138.130.8/analysis.html. ClamAV also detected this file as Win.Exploit.CVE_2022_30190-9951234-1, indicating a known exploit. The embedded OLE object and external relationship strongly suggest an attempt to download and execute a secondary payload.

Heuristics 6

  • External OLEObject gadget — CVE-2021-40444 critical CVE exact CVE_2021_40444
    External relationship to http://212.138.130.8/analysis.html! — exploitable external OLEObject gadget pattern for CVE-2021-40444
    URL http://212.138.130.8/analysis.html
  • ClamAV: Win.Exploit.CVE_2022_30190-9951234-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Exploit.CVE_2022_30190-9951234-1
  • External OLE object relationship high OOXML_EXTERNAL_OLE_OBJECT
    Document contains an oleObject relationship whose target is an external HTTP(S) URL. Office resolves this through OLE/object update paths rather than as a normal user-clicked hyperlink.
    URL http://212.138.130.8/analysis.html
  • External relationship medium OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: http://212.138.130.8/analysis.html!
    URL http://212.138.130.8/analysis.html
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Ole10Native inner payload size exceeds remaining bytes medium OFFICE_PACKAGE_SIZE_MISMATCH
    The inner `payloadSize` field declares more bytes than remain in the Ole10Native stream. Readers that allocate from this field and copy without checking are an OOB-read primitive.

Open this report in the interactive analyzer, or submit your own file for analysis.