Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 a05a91f1a081c4b5…

MALICIOUS

Office (OOXML)

18.9 KB Created: 2021-07-11 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 4d3d4f79abbe22593b36923eb8e396a2 SHA-1: 73de186e9de27d402d8d985279d1353c6d0ad0da SHA-256: a05a91f1a081c4b5e682d5d6598c508cdab942e62557eeebffdb0ea6216e6aa0
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The presence of an AutoOpen VBA macro and the ClamAV detection strongly indicate malicious intent. The VBA code appears to be designed to download and execute a second-stage payload, likely leveraging the `CreateProcess` API. The `macros.bas` file contains complex API declarations and structures, suggesting sophisticated evasion or payload delivery mechanisms.

Heuristics 5

  • ClamAV: Doc.Malware.Valyria-10012625-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10012625-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
08896a3fbb0d70aca1bb46ed69e88fea46bedb663138351668185ff10193b1d1		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4449 bytes
vbaProject_00.bin
464e9f9d0b5fbbdc4549cc538466b1bbdd04cbce24e65193ebfd22a3fb3154f3		 vba-project OOXML VBA project: word/vbaProject.bin 18944 bytes
Detection
ClamAV: Doc.Malware.Valyria-10012625-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.