Nanocore — Office (OOXML) malware analysis

Static analysis result for SHA-256 f40e4633286e09e9…

MALICIOUS

Office (OOXML)

26.9 KB Created: 2021-03-27 07:37:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-04-10
MD5: d8920bae87b16f748fd9e904271aa7f4 SHA-1: fcd752ddb5ff4c34c3e1514decb7e388c2ef67b2 SHA-256: f40e4633286e09e93d57798a17310a52964cd9817fbd3ad4f8b621afb9b524fa
204 Risk Score

Malware Insights

Nanocore · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV with the signature Win.Dropper.Nanocore-10030076-0. It contains an embedded OLE object that drops an executable file named 'Payload.exe'. A URL, 'https://001.0.861.291', was recovered from this embedded object, suggesting it's a download source for the payload. The presence of an embedded executable and a URL strongly indicates a dropper or downloader functionality.

Heuristics 5

  • ClamAV: Win.Dropper.Nanocore-10030076-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.Nanocore-10030076-0
  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://001.0.861.291 In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 30720 bytes
SHA-256: c09e663ee811c23168adc44a617bae342a197f517b82e3172d4749610414db13
Detection
ClamAV: Win.Dropper.Nanocore-10030076-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 27990 bytes
SHA-256: a35c5178ab85964ebbd8844d3779541e1d573f7403b3648feffac272f16ce132
Detection
ClamAV: Win.Dropper.Nanocore-10030076-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00_Payload.exe ole-package-payload OOXML word/embeddings/oleObject1.bin Ole10Native payload: display_name=Payload.exe; full_path=C:\Users\LORD\AppData\Local\Temp\Payload.exe; temp_path=; def_file= 27648 bytes
SHA-256: 6607724aba16a2f11e6e85dc76cd13c42b43925953318663800e8fd2f3f592c4
Detection
ClamAV: Win.Dropper.Nanocore-10030076-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 5164 bytes
SHA-256: f621692e191f5111e959e37ccad4da687d42ae6c3cae34369347de6f8c91b0db

Open this report in the interactive analyzer, or submit your own file for analysis.