Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 38d3a71dfd20e3c6…

MALICIOUS

Office (OOXML) / .DOC

3.25 MB Created: 2022-08-15 01:30:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2022-08-15
MD5: afa42a5b58d8c5e5ccca2ebe652d93d2 SHA-1: ff258d1a88342e6cfcaaca5b866756f2ebe98f53 SHA-256: 38d3a71dfd20e3c6db4d8fe456a44e945728cebbf517b700d799d7bcdf23d9e3
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OOXML document containing a VBA project with a renamed part to evade detection. The presence of a Document_Open macro, GetObject, and CallByName calls indicates malicious intent. The extracted VBA script, though obfuscated, likely attempts to download and execute a secondary payload, as suggested by the ClamAV detection signature 'Doc.Downloader'.

Heuristics 7

  • ClamAV: Doc.Downloader.9f7ec430680ff08e-OOXML-9981523-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.9f7ec430680ff08e-OOXML-9981523-0
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/PtxvycNlrR.bin)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b161e1369391830f5402739a63f88c51a9d374369f1ca706cb5e5422cc5fe4cc		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 11811 bytes
vbaProject_00.bin
44bca50c43e6f1aadddc795ce7d56d48ad22ee6fe53af6c9106adf2f959afe31		 vba-project OOXML VBA project: word/PtxvycNlrR.bin 13312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.