Office (OOXML) malware analysis — malicious · ff92551f94330229

MALICIOUS

Office (OOXML)

666.4 KB

MD5: 09137f5186854cad56d45e896d6c71c5 SHA-1: 4c1a5b0064c63e7057725822334121fb974016c2 SHA-256: ff92551f9433022929b09b6a684efe956a0a3359e9f74badf8849ada27bb7fc3

110 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample contains an embedded Equation Editor OLE object with an anomalous Ole10Native stream, indicating it likely exploits a vulnerability for client execution. The document body and external hyperlinks suggest a lure related to cryptocurrency and financial news, consistent with phishing or scam campaigns.

Heuristics 5

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/ftFWPXwoh.zAR5 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
External hyperlinks (710) low OOXML_EXTERNAL_HYPERLINKS

Document contains 710 external hyperlinks — clickable URLs are stored as external relationships. First target: https://www.reddit.com/r/dogecoin
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.iconomi.net/
- https://www.coinist.io/press-releases/
- https://blockstack.org/
- https://icopressrelease.com/
- http://www.icoduniya.com/
- http://btcwarriors.com/
- https://www.tezos.com/
- https://bitcoinblackhat.com/
- https://crypto20.com
- https://coinforum.ca
- https://tokenbox.io/
- http://altcoinalerts.com/press-releases-ico/
- https://grayscale.co/
- http://icocrowd.com/send-a-press-release/
- https://www.taas.fund/
- http://worldcoinindex.com/
- https://www.bitcoin-millionaire.com/forums/
- https://thetoken.io/
- https://icotimeline.com/tag/press-release/
- http://tokenmarket.net/
- https://bitco.in/forum/
- https://blackmooncrypto.com/
- https://coindelite.com/ico-press-release/
- https://bitcoinforum.com
- https://www.astronaut.capital/
- http://icocalendar.today/
- http://blockchain.capital/
- https://icopanic.com/submit-press-release/
- http://coinschedule.com/
- https://thebitcoinstrip.com/free-bitcoins/
- https://satoshi.fund/
- https://blokt.com/submit-a-press-release
- http://52ico.com/
- https://bitcoingarden.org/forum/
- https://www.panteracapital.com/
- https://bitcoinexchangeguide.com/ico-press-release-marketing/
- http://icoalert.com/
- https://multicoin.capital/
- https://londonletter.org/submit-ico-press-release/
- http://coinhills.com/
- https://forumbitcoin.co.id
- http://polychain.capital/
- http://cryptocoincharts.info/
- https://triaconta.com/
- https://cryptofame.io/ico-press-release/
- http://allcoin.com/
- https://melonport.com/
- http://bluemagic.info/
- https://bitcoinchaser.com/press-release
- http://icorating.com/
+519 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `e1bfe585b06ff98bf1195e2314452b92615ffc4b291a2d799fc20d0c1e5a5920`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/ftFWPXwoh.zAR5	956928 bytes
`ooxml_oleobject_00_ole10native_00.bin` `189143f27f48bb82db6df827a58d24b37029360a656ce3d45f5b0aad2d8d59e8`	ole-package	OOXML xl/embeddings/ftFWPXwoh.zAR5 Ole10Native stream: oLE10nAtIVE	946737 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.