Office (OOXML) / .DOC malware analysis — malicious · 9657a326bf80fae3

MALICIOUS

Office (OOXML) / .DOC

247.6 KB Created: 2021-02-07 17:10:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: 029a3bf91c50373d9ef7973d15e1a5e4 SHA-1: b7e33a95374a409c05949c369bdc955fbd34b5b9 SHA-256: 9657a326bf80fae3d6af19a2cfb1bbd3f018fe4cf620b6e53bb487d26f705193

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OOXML document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject. This indicates an attempt to automatically execute code when the document is opened. The ClamAV detection and heuristic firings strongly suggest this is a downloader malware. No specific URLs or executable payloads were directly extracted, but the presence of VBA macros and the AutoOpen technique are high-confidence indicators of malicious intent.

Heuristics 6

ClamAV: Doc.Downloader.BlueWord12213-9918951-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.BlueWord12213-9918951-0
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b1cec46e9a52c765ba03e2f8e4750462871c4dc690e02d00b4051e6043063923`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2359 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `ec1f29b9d5e80c279d85c41cbdebeebff26d965f23ab5a651d1fde1ac123bd57`	vba-project	OOXML VBA project: word/vbaProject.bin	97280 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.