Vbs.Backdoor.Msfvenom_Payload-9955777-0 — Office (OOXML) / .DOCX malware analysis

Static analysis result for SHA-256 cf4d6e8ea162d1a7…

MALICIOUS

Office (OOXML) / .DOCX

18.9 KB Created: 2026-01-30 18:52:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-07
MD5: f6dc748a42bc253d5e92032e4f957a63 SHA-1: b0d477d03df93b8f963d6a0050d899b1eca2ccf6 SHA-256: cf4d6e8ea162d1a707e30f185baac149ce7e0d22accfeaef81646a4590f9faec
142 Risk Score

Malware Insights

Vbs.Backdoor.Msfvenom_Payload-9955777-0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is a DOCX document containing an embedded OLE object. Static analysis detected this object as a VBS backdoor payload, specifically identified by ClamAV as Vbs.Backdoor.Msfvenom_Payload-9955777-0. This suggests the document is intended to deliver a malicious backdoor through the embedded object, likely via spearphishing.

Heuristics 3

  • ClamAV: Vbs.Backdoor.Msfvenom_Payload-9955777-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Vbs.Backdoor.Msfvenom_Payload-9955777-0
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2023/wordml/word16duIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2024/wordml/sdtformatlockIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 4608 bytes
SHA-256: 9f7183bca612f83aeeda7d32a4e3efcbc800979676fa1c8e8cf1577538fd67c1
Detection
ClamAV: Vbs.Backdoor.Msfvenom_Payload-9955777-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 2306 bytes
SHA-256: 9c0b75edfac5fb0703f6bf8c6c33b39cce41e2d6bd2a43afb4971bc1042e4eec
Detection
ClamAV: Vbs.Backdoor.Msfvenom_Payload-9955777-0
Obfuscation or payload: unlikely
ooxml_oleobject_00_ole10native_00_shell.zip ole-package-payload OOXML word/embeddings/oleObject1.bin Ole10Native payload: display_name=shell.zip; full_path=C:\Users\Joshg\AppData\Local\Temp\{76F49A8D-9B92-4345-B9D4-F144DA5A01EA}\{E7B9AA57-E43B-47A4-A3F8-35C2495E16BB}\shell.zip; temp_path=; def_file= 1781 bytes
SHA-256: 87a4d5cf0475052ba860b67783e6284e10e09955a338e5fd20bdd8253cc2bf22
Detection
ClamAV: Vbs.Backdoor.Msfvenom_Payload-9955777-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 10668 bytes
SHA-256: dbe16253dfa1fee66c0655e0c8103c2e3749d2f510ca495d983db25d632f4a6f

Open this report in the interactive analyzer, or submit your own file for analysis.