Office (OOXML) / .DOC malware analysis — malicious · 2bcf331952cdecfd

MALICIOUS

Office (OOXML) / .DOC

168.0 KB Created: 2020-08-20 14:07:00 UTC Authoring application: Microsoft Office Word 12.0000

MD5: bfe0da0f8c06f532d699bf24efd35cbd SHA-1: 5bcec7de7080a512c15608579ee74428732d44cb SHA-256: 2bcf331952cdecfdfcbd3463c84e33c0b07ade598e694ca9eba464a3bd1463a9

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The OOXML document contains VBA macros, indicated by the 'OOXML_VBA' heuristic. A critical heuristic, 'OLE_VBA_DOWNLOAD', specifically flags the use of the URLDownloadToFile function within the VBA code. This function is commonly used by malware to download and execute a second-stage payload from a remote location. While no specific malicious URLs were extracted from the document body or scripts, the presence and nature of the VBA macro strongly suggest a downloader or droppper attack pattern.

Heuristics 3

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2006/wordml

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5c77557b5cbc07901b5af11216f8636e5016d7f5e0e83c87d50037eec29a1837`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	22329 bytes
`vbaProject_00.bin` `3a65bc2b9b510924d6c05eb43fba59ffce05de4a628143dcdc7a50489997bdf8`	vba-project	OOXML VBA project: word/vbaProject.bin	58368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.