Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 3fd1127d196f1b99…

MALICIOUS

Office (OOXML) / .DOC

44.6 KB Created: 2021-06-08 10:42:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 44a3baae9ace6f6b949473fc39fdbda8 SHA-1: e824bef4f704beea5cb61b69c98145bee54ef6ad SHA-256: 3fd1127d196f1b993a876d8c0c3d3217a800cb605eaa4cca1316a5f3a046069d
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The file is a malicious OOXML document containing a VBA macro. The presence of an AutoOpen macro and calls to Shell() and WScript.Shell indicate that the macro is designed to execute automatically upon opening. This macro likely downloads and executes a second-stage payload, a common technique for initial compromise.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://capablesellersd.com/adda/58793/11057/BNRgCdmIczx3VCKJVxOIM45tzrpZTl8IQ0/1aEcx1CoWhmFmcJ0nt3S5jbf5srAt6I/Zixfk4BkPnuaJ2bmJoaZ3jpFr8ls4HZZGlLkvUG5/paxi4?l8H=IS7kgG&q=icZPU3YxgKSNz7DeyvK&q=arTdnVbJkW1EuzDNQrIxQDv
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/exif/1.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
1c1f9f23bd8fedbe758d9bc3f16567c105a54e5e3f1df312f576879a213f37d1		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1075 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
e1bb4eaeb6f374a4d7fc2f94045eec073ea4d1c668b7e9c95369282ec9cfc9d9		 vba-project OOXML VBA project: word/vbaProject.bin 13824 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.