Sophos Home flags connection to malicious IP by OpenOffice

[spiraledge]

Greetings, I am not sure the best place to post this, but am seeking help with the following incident:

I have Sophos Home running, and received the following alert:
Malicious traffic detected: 'C2/Generic-A' at '/Applications/OpenOffice.app/Contents/MacOS/soffice' This application was detected connecting to a known bad website.

Having contacted their support, I have the IP that was connected too, and can provide if required. At the time, Open Office was not running, I am almost certain. I've never had such alerts before, and hadn't updated Open Office recently.

Can anyone shed any light on this? It would be good to know if it is a false positive, or not.

[RoryOF]

Have you updated your virus definitions? If not, please do and check again.

[spiraledge]

Thanks for reply. Sophos Home has updated itself at least once since this happened, and I've just done so manually, although I think it was already up to date. But check what? The alert was due to an attempted connection, rather than a scan. Also have done a full system scan, no issues.

[RusselB]

The only times I know of OpenOffice connecting to an IP address are when the address has been programmed into a macro, which has to be manually done, or when the Update checker is activated.
The Update checker hasn't worked in months and I'm not sure if it can be configured to check automatically or not.
While I think this was a fluke, rather than a false positive, I would be interested in knowing what the IP address was so that further investigations of that address can be conducted.

[Villeroy]

There lots of modified versions of OpenOffice, all of them carrying some "extra payload". If your copy of OpenOffice does not originate from https://openoffice.org/ you never know what you have downloaded.
You can and should verify your downloaded package before installing it: https://www.openoffice.org/download/checksums.html