Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 8d47d9b15f810c67…

MALICIOUS

Office (OOXML) / .DOC

104.2 KB Created: 2020-06-02 14:31:00 UTC Authoring application: Microsoft Office Word 15.0000
MD5: e615c49160c4409c01bfc4ed914b3503 SHA-1: a288eb966926091450793c27ee63fcc701ac75c7 SHA-256: 8d47d9b15f810c672083a6b9e0f0c2332e92a3d21a7ed8befe74d01c128421dd
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The OOXML document contains a VBA project with a Document_Open macro, indicating an attempt to automatically execute malicious code upon opening. The presence of CreateObject calls suggests the macro is designed to instantiate objects for further malicious actions, likely downloading and executing a second-stage payload. No specific family could be identified, and no IOCs were directly extractable from the provided evidence.

Heuristics 5

  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d2c62565166aa6394c3a716afa941e6eab73918ca553129ef6dff8fd6ff86a57		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1875 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
fd20d87de4629d3e80390c9e293d745a885bcb8d6421fe284c345001055a3738		 vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.