Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f262b401a18c921e…

MALICIOUS

Office (OOXML)

62.5 KB Created: 2019-03-20 08:45:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-01-11
MD5: a4fb4a692c1c2d2e48055f6f4e4751c7 SHA-1: fa792995d45f72f4cd79f9b06380b68716648759 SHA-256: f262b401a18c921e9d1a73e90d0c7c75a5a88098ae0a381fd07e2d656d576864
170 Risk Score

Heuristics 5

  • ClamAV: Doc.Exploit.DDEautoexec-6346603-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.DDEautoexec-6346603-1
  • Malicious DDE command critical OOXML_DDE_MALICIOUS
    DDE field in word/footer1.xml launches a dangerous executable: \\Microsoft\\Office\\MSWord\\..\\..\\..\\..\\windows\\system
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External hyperlinks (3) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 3 external hyperlinks — clickable URLs are stored as external relationships. First target: #
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://[2a07:1182:300:39:250:56ff:fe9e:2ca7]:8080/search Document hyperlink
    • http://schemas.microsoft.com/office/drawing/2014/chartexDocument hyperlink
    • http://schemas.openxmlformats.org/markup-compatibility/2006Document hyperlink
    • http://purl.oclc.org/ooxml/officeDocument/relationshipsDocument hyperlink
    • http://purl.oclc.org/ooxml/officeDocument/mathDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingDocument hyperlink
    • http://purl.oclc.org/ooxml/drawingml/wordprocessingDrawingDocument hyperlink
    • http://purl.oclc.org/ooxml/wordprocessingml/mainDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2012/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2015/wordml/symexDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkDocument hyperlink
    • http://schemas.microsoft.com/office/word/2006/wordmlDocument hyperlink
    • https://www.linkedin.com/in/george-lucas-817922178/?jobid=1234Document hyperlink
    • http://europass.cedefop.europa.euDocument hyperlink

Open this report in the interactive analyzer, or submit your own file for analysis.