Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 d219b73f42f9bf96…

MALICIOUS

Office (OOXML) / .DOCX

176.1 KB Created: 2020-01-28 09:32:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: a5e15cbb8d7b513b12266ae6ff2708ce SHA-1: 35629faac6ddb4258ca3bc9012187548403243ca SHA-256: d219b73f42f9bf965c6e23207f6a9be2a68733f4663806ebf21dcef8078ff57a
220 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059.001 PowerShell

The file is a malicious OOXML document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The presence of ClamAV detections (Doc.Malware.Generic-7566008-0) further confirms its malicious nature. The macro likely downloads and executes a second-stage payload, though the specific URL or payload is not directly extractable from the provided evidence. The GetObject call within the VBA code suggests interaction with external resources or system objects.

Heuristics 6

  • ClamAV: Doc.Malware.Generic-7566008-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-7566008-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
05c4f973404949ed9a20880259ed649fc8fa366f22e5b64e5887d6eb079e6cac		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 40754 bytes
vbaProject_00.bin
744d3a31abe23ddace682b5a960a7e15a502b6af03ed05ed76916b5747622f1a		 vba-project OOXML VBA project: word/vbaProject.bin 322048 bytes
Detection
ClamAV: Doc.Malware.Generic-7566008-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.