Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 d743387d62adc05a…

MALICIOUS

Office (OOXML) / .DOC

91.2 KB Created: 2020-12-02 03:05:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 9ff7d72eb0f967be41fafb65cbe23e52 SHA-1: b05b58be65a18493826cc9a1e8478491221cd940 SHA-256: d743387d62adc05ac35ae35b11f8a68ad04d9be0ed811ebd3169b740dbf9cdb0
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The file is identified as malicious by ClamAV and exhibits high-severity heuristics for VBA macros, including an AutoOpen macro and CreateObject calls. The presence of VBA macros suggests the document is designed to execute code automatically when opened. This code likely downloads and executes a second-stage payload, as indicated by the 'Doc.Downloader' detection name. No specific family could be identified, but the delivery mechanism is clearly macro-based.

Heuristics 6

  • ClamAV: Doc.Downloader.87f88707f007f878-OOXML-9981544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.87f88707f007f878-OOXML-9981544-0
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0c3af0c3294333598b22cfb0c591ab2a896e93a5d2bb86717c51f5cad2e90065		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 9509 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
1bf757972a695aa286bbb7c950a1411e13095b24ae8be5d939782ffc2a7409e5		 vba-project OOXML VBA project: word/vbaProject.bin 44544 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.