MALICIOUS
122
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The file exhibits characteristics of a downloader, specifically triggering heuristics for remote template injection and external relationships pointing to a suspicious URL. The ClamAV detection as 'Doc.Downloader.Redline-9972754-0' strongly suggests its role in fetching and executing further malicious content. The primary IOC is the remote template URL, which is likely used to host the next stage of the attack.
Heuristics 4
-
ClamAV: Doc.Downloader.Redline-9972754-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Redline-9972754-0
-
Remote template injection high OOXML_REMOTE_TEMPLATEDocument references a remote template URL (http://103.167.90.69/document/invoice_00930003322.wbk) — a common remote-template-injection vector used by Hancitor, Emotet and many phishing campaigns. Word can fetch and apply the remote template; macros in that template may execute depending on Office policy and trust state.
-
External relationship medium OOXML_EXTERNAL_RELExternal target in word/_rels/webSettings.xml.rels: http://103.167.90.69/document/invoice_00930003322.wbk
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://103.167.90.69/document/invoice_00930003322.wbk
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2006/wordml
Open this report in the interactive analyzer, or submit your own file for analysis.