Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 cf7a4cebce2586f9…

MALICIOUS

Office (OOXML) / .DOC

66.1 KB Created: 2021-05-25 09:30:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 660fd274ae4783e18d11d6704e7f5e0d SHA-1: 355d7d6162c7360647a5dd9aaf5e90bc5e4e00da SHA-256: cf7a4cebce2586f9dad4a49975fb26f2ccc7968400dddddf449058998645bf0d
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Compromise T1566.001 Phishing T1071.002 Remote Services - SMB

The file's metadata and heuristic firings confirm the presence of VBA macros and an embedded URL. The Document_Open macro, combined with the GetObject call, indicates an attempt to execute malicious code upon document opening. The embedded URL likely points to a server hosting a secondary payload, which is then executed. The presence of a VBA project suggests a more complex attack, potentially involving data exfiltration or system compromise. The use of GetObject is a common technique to evade detection.

Heuristics 4

  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/photoshop/1.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
eb3448912e502d87d4d05824800a919bfcad17a6c78fcbcd65cabb744042097e		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 961 bytes
vbaProject_00.bin
e71774f2721c07faf420c744a325edf493567903767f31fcac72ef3df8c74fc8		 vba-project OOXML VBA project: word/vbaProject.bin 17408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.