Win.Packed.NetWire-10024619-0 — Office (OOXML) malware analysis

Static analysis result for SHA-256 f293f030e628c8e2…

MALICIOUS

Office (OOXML)

584.5 KB Created: 2020-02-20 07:55:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2020-07-24
MD5: 631a1d470d7aa969edc64f95d8447e16 SHA-1: 288b7b3a7bceefa4aac9e21ee7cee46c055ff2d2 SHA-256: f293f030e628c8e209f65bca4d248fc98e49c244fdce1c3ff2cd761b6dc3c3a9
204 Risk Score

Malware Insights

Win.Packed.NetWire-10024619-0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1129 Shared Module Overwrite

The sample is identified as malicious by ClamAV with the signature Win.Packed.NetWire-10024619-0. It contains an embedded OLE object with indicators for exploitation, specifically mentioning CVE-2026-21514. This object is packaged to drop an auto-executable payload, likely an executable file, which is a common technique for delivering malware. The embedded URLs suggest potential command and control or payload download locations.

Heuristics 5

  • ClamAV: Win.Packed.NetWire-10024619-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Packed.NetWire-10024619-0
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (5 URLs) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.smartassembly.com/webservices/UploadReportLogin/ In document text (OOXML body / shared strings)
    • http://www.smartassembly.com/webservices/Reporting/In document text (OOXML body / shared strings)
    • http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURLIn document text (OOXML body / shared strings)
    • http://www.smartassembly.com/webservices/Reporting/UploadReport2In document text (OOXML body / shared strings)
    • http://www.smartassembly.com/webservices/UploadReportLogin/`In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://sawebservice.red-gate.com/In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 345600 bytes
SHA-256: a53368112ca37dc0abb30276e6ca18aacbcd03d54bce39f0cd86d3aad9478b32
Detection
ClamAV: Win.Packed.NetWire-10024619-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 339978 bytes
SHA-256: 59533e6378317660f7302cd872a50cea23291a718a18d86bdf96cb84748446f0
Detection
ClamAV: Win.Packed.NetWire-10024619-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 7876 bytes
SHA-256: 99bfe4e4b3b7fc3f68b5b0da1aa3f250b68c76ec7157d7aab358d3acafdf53ee

Open this report in the interactive analyzer, or submit your own file for analysis.