Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 dfb9423dfa4f60dc…

MALICIOUS

Office (OOXML)

56.6 KB Created: 2017-05-12 06:54:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2018-02-07
MD5: 6bd3d61b47cbd17515bdbae2cfa059b6 SHA-1: c42218e6ca37e75c838c09d29364d60cc7e0e3a5 SHA-256: dfb9423dfa4f60dcfc5b8e66bbead6dd253497998670e67bf56b5e3f61635cf4
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious OOXML document containing embedded OLE objects. One heuristic indicates that the Ole10Native package drops an auto-executable payload, likely JavaScript. The document body contains a lure suggesting the user should select a preferred format to open 'transaction details', which is a common phishing pretext. The embedded OLE objects are the primary indicators of malicious activity.

Heuristics 3

  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject3.bin 52224 bytes
SHA-256: 3b83a8d775ea62ea2053780db62723cc53bd00a0f6b3256fe8c0e508b5487099
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject3.bin Ole10Native stream: Ole10Native 48650 bytes
SHA-256: a262eb50c57f4613a743e57e6b58161767c655aae01043b3c453660c6bcfc550
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject2.bin 52224 bytes
SHA-256: 31c7b4a763401c2fdb51841fde11d99c084ebb6629b830c4d3184638c8e9fc86
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 48641 bytes
SHA-256: b2f48b3bceea63ff7e4620d3afe3813da0b06dcd5e47d18ca4c9cbacc5f7f476
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 52224 bytes
SHA-256: 595dc9a99fcc24c5952e631e83388be11a176fef999e466bdf6a9032948f65e7
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 48659 bytes
SHA-256: 49aab153d35ef52d27dddb06bc4ef038f36bde4af049ffcaf5b98d1e8f7a13f8
emf_00.emf ooxml-emf OOXML EMF part: word/media/image4.emf 7444 bytes
SHA-256: 88df92a0a7f5b0ee4460140180fead708613d43e0d08112be40d5ebf1895ec04
emf_01.emf ooxml-emf OOXML EMF part: word/media/image3.emf 7436 bytes
SHA-256: 3e4628079096d5c28d12b56cad563ce6d28026709639e11ac315fb21ee1a0d1f
emf_02.emf ooxml-emf OOXML EMF part: word/media/image2.emf 7492 bytes
SHA-256: e659ae7b52dc5b71c6c02e0c9dd9bafd6235a4e42cde335b7b861db8480c9841

Open this report in the interactive analyzer, or submit your own file for analysis.