Bare IPv4 host in VBA macro

OLE_VBA_BARE_IPV4_LITERAL

← All detection heuristics · Office Macros

info OLE_VBA_BARE_IPV4_LITERAL

What it means

VBA macro source contains a globally routable IPv4 address written as a bare dotted quad.

Why it fires

The macro hardcodes a public IP address with no URL scheme around it, so scheme-anchored URL extraction never sees it. Droppers use this to reach a command-and-control host without a resolvable domain — for example writing an FTP command script ("o 203.0.113.10", "user anonymous") and running ftp -s: against it. Private, loopback, link-local, CGNAT and reserved ranges are excluded, and version/build strings such as 16.0.0.0 are filtered out, so a benign macro rarely trips this.

Other Office Macros heuristics

OLE_VBA_XOR_DECODED_SHELL OLE_VBA_DOCUMENT_BODY_DROP_EXEC OLE_VBA_SPLIT_KEYWORD_OBFUSCATION OLE_VBA_AUTOEXEC_NORMAL_TEMPLATE_VIRUS OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER OLE_RAW_MACRO_NATIVE_MEMORY_CALLBACK_LOADER OOXML_VBA_CELL_URL_DROPPER OLE_VBA_REACHABLE_HTTP_DROP_EXEC OLE_VBA_HTTP_DROP_EXEC OLE_VBA_HTTP_RESPONSE_COMMAND_EXEC OLE_VBA_CELL_GETOBJECT_EXEC OLE_VBA_XLM_CALL_INJECTION OLE_VBA_NATIVE_MEMORY_CALLBACK_LOADER OLE_VBA_BITSTRANSFER_DROPPER OLE_VBA_USERFORM_CMD_DROPPER OOXML_VBA_DEFINED_NAME_NETWORK_CONSUMED OOXML_VBA_DYNAMIC_CELL_URL_SOURCE OLE_VBA_HOSTS_FILE_HIJACK OLE_VBA_KEYLOGGER_SPYWARE OOXML_VBA_CELL_IMAGE_SOURCE